Microsoft SCOM Security Technical Implementation Guide

The Microsoft SCOM Security Technical Implementation Guide (V1 R2) has 19 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

19STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Wed Apr 02 2025

If a certificate is used for the SCOM web console, this certificate must be generated by a DoD CA or CA approved by the organization.

Microsoft SCOM Security Technical Implementation Guide

Assessment Title

Rule Text

If a certificate is used for the SCOM web console, this certificate must be generated by a DoD CA or CA approved by the organization.

Description

Discussion Text

Web certificates should always be signed by a trusted signer and never self-signed.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-237434

Rule

SV-237434r961863_rule

Severity

low

Rule Version

SCOM-CM-000003

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the web console server, open IIS. Right-click on the Default Website and choose Edit Bindings. Select the https binding and click edit. Click View to view the certificate being used to protect the website. If the certificate is not issued by a DoD CA or a trusted internal CA, this is a finding.

Implementation Procedure

Fix Text

Issue a web corticated from a trusted internal CA server as this will be required for https protocols to function properly. It will need to be installed on the server in advance.

From the SCOM web console server, open IIS. Right-click on the Default Website and choose edit bindings. Click on the https binding and click edit. For the SSL certificate drop down, choose the new certificate. Click OK. Test https access to the SCOM web console and troubleshoot if connectivity is not working. Once connectivity is established, delete the http binding.

STIG check 12 of 19 in the Microsoft SCOM STIG checklist

← Previous · V-237433SCOM unsealed management packs must be backed up regularly.Next · V-237435 →The Microsoft SCOM SNMP Monitoring in SCOM must use SNMP V3.