← Back to Microsoft Windows Server 2016 Security Technical Implementation Guide

V-271430

CAT I (High)

Windows Server 2016 must be configured for name-based strong mappings for certificates.

Rule ID

SV-271430r1059573_rule

STIG

Microsoft Windows Server 2016 Security Technical Implementation Guide

Version

V2R10

CCIs

CCI-000213

Discussion

Weak mappings give rise to security vulnerabilities and demand hardening measures. Certificate names must be correctly mapped to the intended user account in Active Directory. A lack of strong name-based mappings allows certain weak certificate mappings, such as Issuer/Subject AltSecID and User Principal Names (UPN) mappings, to be treated as strong mappings.

Check Content

This requirement is not applicable for Member Servers.

Note: This requirement is a permanent finding for server 2016 domain controllers per DOD CIO Memo Upgrading of MS Domain Controller OS to MS Server 2019 or Later (CIO000911-23).

If the server is acting as a domain controller, this is a finding.

Fix Text

For servers acting as a domain controller, upgrade the operating system to Microsoft Server 2019 or greater.