The Windows PAW must be configured to enforce two-factor authentication and use Active Directory for authentication management.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-243457	WPAW-00-001600	SV-243457r997927_rule		Medium

Description
Due to the highly privileged functions of a PAW, a high level of trust must be implemented for access to the PAW, including nonrepudiation of the user session. One-factor authentication, including username and password and shared administrator accounts, does not provide adequate assurance.

STIG	Date
Microsoft Windows PAW Security Technical Implementation Guide	2024-06-13

Details

Check Text ( C-46732r997925_chk )
Review the configuration on the PAW. Verify group policy is configured to enable either smart card or another DOD-approved two-factor authentication method for site PAWs. - In Active Directory, go to Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - Verify "Interactive logon: Require Windows Hello for Business or smart card" is set to "Enabled". If group policy is not configured to enable either smart card or another DOD-approved two-factor authentication method, this is a finding.

Check Text ( C-46732r997925_chk )

Review the configuration on the PAW.

Verify group policy is configured to enable either smart card or another DOD-approved two-factor authentication method for site PAWs.

- In Active Directory, go to Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.
- Verify "Interactive logon: Require Windows Hello for Business or smart card" is set to "Enabled".

If group policy is not configured to enable either smart card or another DOD-approved two-factor authentication method, this is a finding.

Fix Text (F-46689r997926_fix)
In Active Directory, configure group policy to enable either smart card or another DOD-approved two-factor authentication method for all PAWs. - Go to Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - Set "Interactive logon: Require Windows Hello for Business or smart card" to "Enabled".