All accounts installed with the IIS 10.0 web server software and tools must have passwords assigned and default passwords changed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-218823	IIST-SV-000156	SV-218823r561041_rule		High

Description
During installation of the web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community. The first things an attacker will try when presented with a logon screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password, making the logon even easier. Once the web server is installed, the passwords for any created accounts should be changed and documented. The new passwords must meet the requirements for all passwords, i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc. Service accounts or system accounts that have no logon capability do not need to have passwords set or changed.

Description

During installation of the web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community. The first things an attacker will try when presented with a logon screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password, making the logon even easier. Once the web server is installed, the passwords for any created accounts should be changed and documented. The new passwords must meet the requirements for all passwords, i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc. Service accounts or system accounts that have no logon capability do not need to have passwords set or changed.

STIG	Date
Microsoft IIS 10.0 Server Security Technical Implementation Guide	2021-03-24

Details

Check Text ( C-20295r310944_chk )
Access the IIS 10.0 web server. Access the "Apps" menu. Under "Administrative Tools", select "Computer Management". In left pane, expand "Local Users and Groups" and click "Users". Review the local users listed in the middle pane. If any local accounts are present and used by IIS 10.0, verify with System Administrator that default passwords have been changed. If passwords have not been changed from the default, this is a finding.

Check Text ( C-20295r310944_chk )

Access the IIS 10.0 web server.

Access the "Apps" menu. Under "Administrative Tools", select "Computer Management".

In left pane, expand "Local Users and Groups" and click "Users".

Review the local users listed in the middle pane.

If any local accounts are present and used by IIS 10.0, verify with System Administrator that default passwords have been changed.

If passwords have not been changed from the default, this is a finding.

Fix Text (F-20293r310945_fix)
Access the IIS 10.0 web server. Access the "Apps" menu. Under Administrative Tools, select Computer Management. In left pane, expand "Local Users and Groups" and click on "Users". Change passwords for any local accounts present that are used by IIS 10.0, then verify with System Administrator default passwords have been changed. Develop an internal process for changing passwords on a regular basis.

Fix Text (F-20293r310945_fix)

Access the IIS 10.0 web server.

Access the "Apps" menu. Under Administrative Tools, select Computer Management.

In left pane, expand "Local Users and Groups" and click on "Users".

Change passwords for any local accounts present that are used by IIS 10.0, then verify with System Administrator default passwords have been changed.

Develop an internal process for changing passwords on a regular basis.