UCF STIG Viewer Logo

Caching of logon credentials must be limited.


Overview

Finding ID Version Rule ID IA Controls Severity
V-225467 WN12-SO-000024 SV-225467r569185_rule Low
Description
The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.
STIG Date
Microsoft Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide 2022-03-01

Details

Check Text ( C-27166r471743_chk )
If the system is not a member of a domain, this is NA.

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

Value Name: CachedLogonsCount

Value Type: REG_SZ
Value: 4 (or less)
Fix Text (F-27154r471744_fix)
If the system is not a member of a domain, this is NA.

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Number of previous logons to cache (in case Domain Controller is not available)" to "4" logons or less.