The service account ID used to run the web service must have its password changed at least annually.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2235	WG060 IIS6	SV-38189r1_rule	IAIA-1 IAIA-2	Medium

Description
Normally, a service account is established for the web service to run under rather than permitting it to run as system or root. The password on such accounts must be changed at least annually. It is a fundamental tenet of security that passwords are not to be null and not to be set to never expire.

STIG	Date
IIS6 Server	2015-06-01

Details

Check Text ( C-37627r1_chk )
1. Go to Start > Administrative Tools > Services. 2. Right click on service name World Wide Web Publishing Service > Select Properties > Select Log On tab. 3. The username next to “This account” is the web service account ID. 4. Open a command prompt and enter “Net User [service account ID]” > Press Enter 5. Verify the values for Password last set and Password expires to ensure the password has been changed in the past year, and will be required to change within the coming year. If the service account ID is not configured according to the guidelines in step 5, this is a finding. NOTE: For IIS installations that are running as localsystem, the password is changed automatically by the OS every 7 days, so this should be marked as N/A.

Check Text ( C-37627r1_chk )

1. Go to Start > Administrative Tools > Services.
2. Right click on service name World Wide Web Publishing Service > Select Properties > Select Log On tab.
3. The username next to “This account” is the web service account ID.
4. Open a command prompt and enter “Net User [service account ID]” > Press Enter
5. Verify the values for Password last set and Password expires to ensure the password has been changed in the past year, and will be required to change within the coming year.

If the service account ID is not configured according to the guidelines in step 5, this is a finding.

NOTE: For IIS installations that are running as localsystem, the password is changed automatically by the OS every 7 days, so this should be marked as N/A.

Fix Text (F-32869r1_fix)
Configure the service account ID used to run the web site to have its password changed at least annually.