Module 6: Secure Operations & Maintenance
This directory contains operational procedures and configuration baselines for system backups, offline patch distribution, and regular security auditing.
Technical Hardening Controls
REQ-OPS-001 - Enforce KRBTGT Password Rotation Enforces and audits periodic rotation of the domain KRBTGT account password to prevent Golden Ticket attacks.
REQ-OPS-002 - Enable and Configure the Active Directory Recycle Bin Enables the forest-wide Recycle Bin optional feature to preserve all link-valued attributes and permit rapid recovery of deleted objects.
REQ-OPS-003 - Establish and Maintain Group Policy ADMX Central Store Centralizes ADMX administrative templates within the SYSVOL share to prevent console drift and version mismatches.
REQ-OPS-004 - Implement Third-Party and Custom GPO Templates for COTS Hardening Enforces standardized configuration templates to lock down third-party application configurations (browsers, reader software, security guides).
REQ-OPS-005 - Configure Dedicated WSUS for Tier 0 Establishes and secures dedicated WSUS update server endpoints for Tier 0 assets to prevent cross-tier update spoofing.
REQ-OPS-006 - Redirect Default Users and Computers Containers Redirects newly created user and computer objects to dedicated, deletion-protected Organizational Units (OUs) to enforce policy application.
REQ-OPS-007 - Mandate Naming Conventions for GPOs, OUs, and User Accounts Enforces consistent prefixes and structures for directory objects and mandates a standard GPO description template to support programmatic auditing.
REQ-OPS-008 - Configure Daily System State Backups Enforces daily DC System State backups to secure, offline storage to enable clean bare-metal recovery.
REQ-OPS-009 - Implement Offline Patch Management via WSUS Establishes secure, offline wsusutil metadata import/export processes for air-gapped systems.
REQ-OPS-010 - Establish Continuous Security Assessments Implements a scheduled operational program of offline directory reviews using PingCastle, BloodHound/SharpHound, and ORADAD.
REQ-OPS-011 - Enable Detailed BSOD Stop Parameters for Crash Control Enables detailed crash display screens to facilitate local hardware/system troubleshooting in isolated infrastructures.
REQ-OPS-012 - Implement Automated Inactive Computer and User Account Cleanup Disables and moves inactive user (180 days) and computer (90 days) accounts to a stale OU.
REQ-OPS-013 - Clean Up Staged Install From Media (IFM) Data Deletes temporary ntds.dit datasets immediately after Domain Controller promotions.