Rotate your device back to portrait to use STIG Vault.
The Active Directory Forest Security Technical Implementation Guide (V3 R2) has 7 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.
Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Rule Text
Discussion Text
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.
Verify that a site has set aside one or more PAWs for remote management of AD CS.
A dedicated AD CS/CA Admin account that is only usable on tier 0 PAW or the ADCS server must be used to manage the certificate authority and approve requests.
Review any available site documentation.
Verify that any PAW used to manage high-value IT resources of a specific tier are used exclusively for managing high-value IT resources assigned to only one tier.
If the site has not set aside one or more PAWs for remote management of AD CS, this is a finding.
Configure and set aside one or more PAWs for configuration and management of AD CS.
For AD, multiple configuration items could enable anonymous access.
Set aside one or more PAWs for remote management of high-value IT resources assigned to a specific tier. For example, using the Microsoft Tier 0-2 model, each PAW would be assigned to manage Tier 0, Tier 1, or Tier 2 high-value IT resources.