Windows Server running Active Directory Certificate Services (AD CS) must be managed by a PAW tier 0.
An XCCDF Rule
Description
<VulnDiscussion>Verify that a site has set aside one or more PAWs for remote management of AD CS. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-269099r1026184_rule
- Severity
- High
- References
- Updated
Remediation - Manual Procedure
Configure and set aside one or more PAWs for configuration and management of AD CS.
For AD, multiple configuration items could enable anonymous access.
Set aside one or more PAWs for remote management of high-value IT resources assigned to a specific tier. For example, using the Microsoft Tier 0-2 model, each PAW would be assigned to manage Tier 0, Tier 1, or Tier 2 high-value IT resources.