Windows service \ application accounts with administrative privileges and manually managed passwords, must have passwords changed at least every 60 days.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-243474	AD.0014	SV-243474r723457_rule		Medium

Description
NT hashes of passwords for accounts that are not changed regularly are susceptible to reuse by attackers using Pass-the-Hash. Windows service \ application account passwords are not typically changed for longer periods of time to ensure availability of the applications. If a service \ application also has administrative privileges it will provide elevated access if compromised.

STIG	Date
Active Directory Domain Security Technical Implementation Guide	2021-10-05

Details

Check Text ( C-46749r723455_chk )
If no Windows service \ application accounts with manually managed passwords have administrative privileges, this is NA. Verify Windows service \ application accounts with administrative privileges and manually managed passwords, have passwords changed at least every 60 days.

Fix Text (F-46706r723456_fix)
If no Windows service \ application accounts with manually managed passwords have administrative privileges, this is NA. Change passwords for Windows service \ application accounts with administrative privileges and manually managed passwords, at least every 60 days.