Passwords for enabled local Administrator accounts must be changed at least every 60 days.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-99555	WN10-SO-000280	SV-108659r2_rule		Medium

Description
The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for enabled Administrator accounts on a regular basis will limit its exposure. Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.

Description

The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for enabled Administrator accounts on a regular basis will limit its exposure. Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.

STIG	Date
Windows 10 Security Technical Implementation Guide	2020-06-15

Details

Check Text ( C-98405r2_chk )
Review the password last set date for the enabled local Administrator account. On the local domain joined workstation: Open "PowerShell". Enter "Get-LocalUser –Name * \| Select-Object *” If the "PasswordLastSet" date is greater than "60" days old for the local Administrator account for administering the computer/domain, this is a finding.

Fix Text (F-105239r2_fix)
Change the enabled local Administrator account password at least every "60" days. Automated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to meet this requirement.