Rule version WN25-DC-000070 · STIG v1 · 2026-09-01
Improper access permissions for directory data-related files could allow unauthorized users to read, modify, or delete directory data or audit trails.
Satisfies: SRG-OS-000324-GPOS-00125, SRG-OS-000206-GPOS-00084
This applies to domain controllers. It is not applicable for other systems.
Run "Regedit".
Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters".
Note the directory locations in the values for:
Database log files path DSA Database file
By default, they will be \Windows\NTDS.
If the locations are different, run the following for each:
Open "command prompt (Admin)".
Navigate to the NTDS directory (\Windows\NTDS by default).
Run "icacls *.*".
If the permissions on each file are not as restrictive as the following, this is a finding:
NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F)
(I) - permission inherited from parent container (F) - full access
Maintain the permissions on NTDS database and log files as follows:
NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F)
(I) - permission inherited from parent container (F) - full access