Timer job retries for automatic password change on Managed Accounts must meet DoD password retry policy.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-28249	SHPT-00-000210	SV-37975r2_rule	ECLO-1 ECLO-2	Medium

Description
When an authentication method is exposed to allow for the utilization of an application, there is a risk that attempts will be made to obtain unauthorized access. To defeat these attempts, organizations define the number of times a user account may consecutively fail a log in attempt. The organization also defines the period of time in which these consecutive failed attempts may occur. By limiting the number of failed log in attempts, the risk of unauthorized system access via user password guessing otherwise known as brute forcing is reduced. Limits are imposed by locking the account. The automatic password change feature for Managed Accounts allows SharePoint to automatically generate new strong passwords on a schedule set by the administrator. This generates a password change job in the Timer Service. Limiting the number of times the job attempts to change the password, will help guard against a password change attack.

Description

When an authentication method is exposed to allow for the utilization of an application, there is a risk that attempts will be made to obtain unauthorized access. To defeat these attempts, organizations define the number of times a user account may consecutively fail a log in attempt. The organization also defines the period of time in which these consecutive failed attempts may occur. By limiting the number of failed log in attempts, the risk of unauthorized system access via user password guessing otherwise known as brute forcing is reduced. Limits are imposed by locking the account. The automatic password change feature for Managed Accounts allows SharePoint to automatically generate new strong passwords on a schedule set by the administrator. This generates a password change job in the Timer Service. Limiting the number of times the job attempts to change the password, will help guard against a password change attack.

STIG	Date
SharePoint 2010 Security Technical Implementation Guide (STIG)	2015-10-02

Details

Check Text ( C-37270r3_chk )
1. In SharePoint Central Administration, click Security. 2. On the Security page, in the General Security list, click Configure password change settings. 3. On the Password Management Settings page, in the Automatic Password Change Settings section, verify “Number of retries before password change timer fails:” is set to 3. (Numbers less than 3 are not normally recommended.) 4. Mark as a finding if the “Number of retries before password change timer fails:” is set to a number greater than 3.

Check Text ( C-37270r3_chk )

1. In SharePoint Central Administration, click Security.
2. On the Security page, in the General Security list, click Configure password change settings.
3. On the Password Management Settings page, in the Automatic Password Change Settings section, verify “Number of retries before password change timer fails:” is set to 3. (Numbers less than 3 are not normally recommended.)
4. Mark as a finding if the “Number of retries before password change timer fails:” is set to a number greater than 3.

Fix Text (F-32507r3_fix)
1. In SharePoint Central Administration, click Security. 2. On the Security page, in the General Security list, click Configure password change settings. 3. On the Password Management Settings page, in the Automatic Password Change Settings section, set the “Number of retries before password change timer fails:” to 3.