Active Directory Forest STIG Checklist

15 items · Security · Hard difficulty · 4 hours

Practical AD Forest STIG tasks to secure and audit your Active Directory environment.

• Inventory AD forest topology and domain controllers

  Map domains, sites, DCs, and trust relationships.

• Document and verify FSMO role holders and replication status

  Use repadmin and dcdiag to confirm role locations and healthy replication.

• Harden domain controllers
• Restrict physical access to domain controllers

  Limit access to authorized personnel and keep DCs in locked rooms.

• Enable secure boot and set firmware passwords on DC hardware

  Turn on Secure Boot and configure UEFI/BIOS passwords.

• Disable unnecessary services and roles on domain controllers

  Remove or disable services like print spooler or IIS if not required.

• Enforce password complexity and account lockout policies via GPO

  Set length, complexity, age, and lockout thresholds in domain policy.

• Configure Kerberos settings and ticket lifetimes per STIG

  Set ticket lifetimes, enforce AES, and review renewable ticket policy.

• Restrict and review Domain Admins and Enterprise Admins group membership

  Apply least-privilege principles and audit privileged group memberships.

• Implement GPO security baselines and manage inheritance

  Apply Microsoft or DoD baselines and block inheritance where appropriate.

• Apply all critical Windows Server patches to domain controllers

  Test in lab, then schedule and deploy updates promptly.

• Configure logging, auditing, and forward logs to a central SIEM

  Enable AD audit categories and centralize event collection.

• Secure DNS and LDAP services

  Use secure dynamic updates, restrict zone transfers, and enable LDAPS.

• Protect replication channels and enforce secure RPC/SMB

  Enable SMB signing, enforce RPC/SMB encryption or IPSec where applicable.

• Perform periodic STIG compliance scans and remediate findings

  Run DISA STIG scans, log exceptions, and track remediation until closed.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.