Title

The Windows DNS Server log must be enabled. (Cat II impact)

Discussion

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. The actual auditing is performed by the operating system/network device manager, but the configuration to trigger the auditing is controlled by the DNS server.

Check Content

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. Press the Windows key + R and execute "dnsmgmt.msc". Right-click the DNS server and select "Properties". Click the "Event Logging" tab. By default, all events are logged. Verify "Errors and warnings" or "All events" is selected. If any option other than "Errors and warnings" or "All events" is selected, this is a finding.

Fix Text

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. Press the Windows key + R and execute "dnsmgmt.msc". Right-click the DNS server and select "Properties". Click the "Event Logging" tab. By default, all events are logged. Select the "Errors and warnings" or "All events" option. Click "Apply". Click "OK".

Additional Identifiers

Rule ID: SV-259337r960879_rule

Vulnerability ID: V-259337

Group Title: SRG-APP-000089-DNS-000004

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.