Microsoft Windows Server 2022

Windows Server 2022 must be configured for certificate-based authentication for domain controllers

STIG ID: WN22-DC-000405 | SRG: SRG-OS-000080-GPOS-00048 | Severity: Medium | CCI: CCI-000213 | Vulnerability ID: V-271426

Description

Active Directory domain services elevation of privilege vulnerability could allow a user rights to the system, such as administrative and other high-level capabilities.

Check

C-271426r1059557_chk

This applies to domain controllers. This is not applicable for member servers.If the following registry value does not exist or is not configured as specified, this is a finding:Registry Hive: HKEY_LOCAL_MACHINERegistry Path: SYSTEM\CurrentControlSet\Services\KdcValue Name: StrongCertificateBindingEnforcementValue Type: REG_DWORDValue: 0x00000001 (1) or 0x00000002 (2)

Fix

F-75382r1059556_fix

Configure the registry value.Registry Hive: HKEY_LOCAL_MACHINERegistry Path: SYSTEM\CurrentControlSet\Services\KdcValue Name: StrongCertificateBindingEnforcementValue Type: REG_DWORDValue: 0x00000001 (1) or 0x00000002 (2)