TickYouOff
Sign in
Back
🔒

AD STIG Checklist

Medium 14 items · 4 hours
testuser's avatar
testuser Published 1 month ago
Security

This checklist distills the DISA Active Directory Domain STIG into practical, actionable tasks to harden AD domains. It’s designed for system administrators and security engineers responsible for Windows domain security.

Source: https://ncp.nist.gov/checklist/669

Progress
0 / 14
  1. Inventory domain controllers and AD components — List hostnames, IPs, OS versions, roles, and patch levels.
  2. Apply latest Microsoft security patches to domain controllers — Schedule during maintenance windows and verify reboots.
  3. Verify domain and forest functional levels meet requirements — Confirm supported functionality and compatibility before raising.
  4. Enforce secure LDAP (LDAPS) for AD communications — Install certificates and require LDAP over TLS.
  5. Configure strong password and account lockout policies in Group Policy — Set length, complexity, history, and lockout thresholds.
  6. Restrict and review privileged accounts and groups — Audit memberships, remove unnecessary accounts, and document admins.
  7. Enable and review AD auditing and event logging — Enable advanced auditing and forward events to a SIEM.
  8. Harden domain controllers (disable unnecessary services) — Apply host firewall rules and remove non-essential services.
  9. Disable SMBv1 on domain controllers — Turn off SMBv1 and confirm SMBv2/3 availability.
  10. Remove or disable unused server roles on domain controllers — Uninstall roles like IIS or DHCP if not required on DCs.
  11. Secure DNS integrated with AD and enable DNSSEC where supported — Harden zone permissions and validate dynamic updates.
  12. Backup Active Directory and test restores — Perform system state backups and run restore drills regularly.
  13. Review and apply least-privilege for service and managed accounts — Convert services to managed accounts and remove excessive rights.
  14. Implement multi-factor authentication for administrative access — Require MFA for console, RDP, and privileged tools.
Sign in to save
📝 My Notes