The Tanium Application Server must be configured to only use Microsoft Active Directory for account management functions.

From Tanium 6.5 Security Technical Implementation Guide

Associated with: CCI-000015

SV-81489r1_rule The Tanium Application Server must be configured to only use Microsoft Active Directory for account management functions.

Vulnerability discussion

By restricting access to the Tanium Server to only Microsoft Active Directory, user accounts and related permissions can be strictly monitored. Account management will be under the cog of the Windows Operating System and separate maintenance will not be required.

Check content

Access the Tanium App server through interactive logon. Run regedit as Administrator. Navigate to HKLM\Software\Wow6432Node\Tanium\Tanium Server. Validate the "cac_ldap_server_url" value exists and is configured to point to the site's Active Directory instance. This registry value requires that Tanium validate every CAC/PIV authentication attempt with AD to determine the state of the account that is logging in. It must use the syntax of LDAP:// (Note: All CAPS for LDAP). If the value for "cac_ldap_server_url" does not exist or is not configured to the site's AD instance, this is a finding.

Fix text

Access the Tanium App server through interactive logon. Run regedit as Administrator. Navigate to HKLM\Software\Wow6432Node\Tanium\Tanium Server. Set the value for "cac_ldap_server_url" to reference the site's AD instance. It must use the syntax of LDAP:// (Note: All CAPS for LDAP).

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.