Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
Windows Server 2025 Active Directory (AD) Group Policy Objects (GPOs) must have proper access control permissions.
Description
Discussion Text
When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems relying on the directory service.
For AD, the GPOs require special attention. In a distributed administration model (i.e., help desk), GPOs are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for GPOs, this could allow an intruder to change the security policy applied to all domain client computers (workstations and servers).
For AD, the GPOs require special attention. In a distributed administration model (i.e., help desk), GPOs are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for GPOs, this could allow an intruder to change the security policy applied to all domain client computers (workstations and servers).
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.