Windows 2012/2012 R2 accounts must be configured to require passwords.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-226246	WN12-GE-000015	SV-226246r794535_rule		High

Description
The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords.

STIG	Date
Microsoft Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide	2023-02-27

Details

Check Text ( C-27948r476582_chk )
Review the password required status for enabled user accounts. Open "Windows PowerShell". Domain Controllers: Enter "Get-ADUser -Filter * -Properties PasswordNotRequired \| Where PasswordNotRequired -eq True \| FT Name, PasswordNotRequired, Enabled". Exclude disabled accounts (e.g., Guest) and Trusted Domain Objects (TDOs). If "PasswordNotRequired" is "True" for any enabled user account, this is a finding. Member servers and standalone systems: Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordRequired=False and LocalAccount=True" \| FT Name, PasswordRequired, Disabled, LocalAccount'. Exclude disabled accounts (e.g., Guest). If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding.

Check Text ( C-27948r476582_chk )

Review the password required status for enabled user accounts.

Open "Windows PowerShell".

Domain Controllers:

Enter "Get-ADUser -Filter * -Properties PasswordNotRequired | Where PasswordNotRequired -eq True | FT Name, PasswordNotRequired, Enabled".

Exclude disabled accounts (e.g., Guest) and Trusted Domain Objects (TDOs).

If "PasswordNotRequired" is "True" for any enabled user account, this is a finding.

Member servers and standalone systems:

Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordRequired=False and LocalAccount=True" | FT Name, PasswordRequired, Disabled, LocalAccount'.

Exclude disabled accounts (e.g., Guest).

If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding.

Fix Text (F-27936r476583_fix)
Configure all enabled accounts to require passwords. The password required flag can be set by entering the following on a command line: "Net user [username] /passwordreq:yes", substituting [username] with the name of the user account.