Skip to content

Windows Server 2022 permissions on the Active Directory data files must only allow System and Administrators access.

An XCCDF Rule

Description

Improper access permissions for directory data-related files could allow unauthorized users to read, modify, or delete directory data or audit trails. Satisfies: SRG-OS-000324-GPOS-00125, SRG-OS-000206-GPOS-00084

ID
SV-254391r958726_rule
Version
WN22-DC-000070
Severity
High
References
Updated

Remediation Templates

A Manual Procedure

Maintain the permissions on NTDS database and log files as follows:

NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)

(I) - permission inherited from parent container
(F) - full access