topic Re: Windows AD Trust review in Governance, Risk, Compliance

Windows AD Trust review

Midude2000 — Sat, 23 Jul 2022 21:26:24 GMT

Hello:
I wanted some quick education on important windows AD Trust terminology for an AD trust relationships audit.

I have researched online but I can’t seem to find good business level (the why behind the what) explanations

Specifically; What is meant by the following flag values
SID Filtering Forestaware = false (or true)
SID Filtering Quarintine = false (or true).

what is the significance of these flags, why so, what could go wrong if set one way vs. the other and best practice security settings for them

Re: Windows AD Trust review

dcontesti — Sun, 24 Jul 2022 22:59:59 GMT

Both flags are related to Trust relationships in AD.

It is very difficult to say what can go right/wrong without full understanding of the environment. What trusts are set up? What does the forrest look like? Are these flags being used Internally/externally/ both?

Microsoft Technet has a wealth of knowledge on these flags and others. Here is one link:

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc794801(v=ws.10)?redirectedfrom=MSDN

SID filtering quarantining is typically used to prevent attackers that have compromised a domain controller in a trusted domain to use the SID history attribute to grant themselves unauthorized rights.

Others?

Re: Windows AD Trust review

Caute_cautim — Mon, 25 Jul 2022 00:32:33 GMT

@Midude2000 @dcontesti Personally I would check with the Center for Internet Security (CIS) https://www.cisecurity.org/ they have a range of guidance and baselines and tools, which help you review the current environment.

There is a bunch of free baselines for Microsoft Windows Servers, Desktop etc have a look through those baselines, and register, there is some very good guidelines you can use for reviews and even some tools to check those baselines against as well.

An example of an updated baseline or benchmark is:

https://www.cisecurity.org/insights/blog/update-cis-microsoft-windows-10-enterprise-release-1703-benchmark-v1-0-0

Regards

Caute_Cautim