Title

Security identifiers (SIDs) must be configured to use only authentication data of directly trusted external or forest trust. (Cat II impact)

Discussion

Under some circumstances it is possible for attackers or rogue administrators that have compromised a domain controller in a trusted domain to use the SID history attribute (sIDHistory) to associate SIDs with new user accounts, granting themselves unauthorized rights. To help prevent this type of attack, SID filter quarantining is enabled by default on all external trusts. However, it is possible for an administrator to change this setting or the trust may have been created in an older version of AD. SID filtering causes SID references that do not refer to the directly trusted domain or forest to be removed from inbound access requests in the trusting domain. Without SID filtering, access requests could contain spoofed SIDs, permitting unauthorized access. In cases where access depends on SID history or Universal Groups, failure to enable SID filtering could result in operational problems, including denial of access to authorized users. When the quarantine switch is applied to external or forest trusts, only those SIDs from the single, directly trusted domain are valid. In effect, enabling /quarantine on a trust relationship will break the transitivity of that trust so that only the specific domains on either side of the trust are considered participants in the trust.

Check Content

Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".) Right-click the domain in the left pane and select "Properties". Select the "Trusts" tab. Note any existing trusts and the type. If no trusts exist, this is NA. Access a command line and run the following command on the trusting domain: "netdom trust <trusting domain> /d:<trusted domain> /quarantine" If the result does not specify the following, this is a finding. "SID filtering is enabled for this trust. Only SIDs from the trusted domain will be accepted for authorization data returned during authentication. SIDs from other domains will be removed." If the trust type is Forest, run the following command on the trusting domain: "netdom trust <trusting domain> /d:<trusted domain> /enablesidhistory" If the result does not specify "SID history is disabled for this trust", this is a finding.

Fix Text

Ensure SID filtering is enabled on all external trusts. You can enable SID filtering only from the trusting side of the trust. Enter the following line from a command line: netdom trust <TrustingDomainName> /d:<TrustedDomainName> /quarantine:Yes /usero:<DomainAdministratorAcct> /passwordo:<DomainAdminPwd> Ensure SID history is disabled for all forest trusts. You can disable SID history only from the trusting side of the trust. Enter the following line from a command line: netdom trust <TrustingDomainName> /d:<TrustedDomainName> /enablesidhistory:No /usero:<DomainAdministratorAcct> /passwordo:<DomainAdminPwd>

Additional Identifiers

Rule ID: SV-243484r890561_rule

Vulnerability ID: V-243484

Group Title: SRG-OS-000104

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.