Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-6840 | 4.026 | SV-25211r1_rule | IAIA-1 IAIA-2 | Medium |
Description |
---|
Passwords that do not expire or are reused increase the exposure of a password with greater probability of being discovered or cracked. |
STIG | Date |
---|---|
Windows 7 Security Technical Implementation Guide | 2012-08-22 |
Check Text ( C-3230r1_chk ) |
---|
Using the DUMPSEC utility: Select “Dump Users as Table” from the “Report” menu. Select the available fields in the following sequence, and click on the “Add” button for each entry: UserName SID PswdRequired PswdExpires PswdLastSetTime LastLogonTime AcctDisabled Groups If any accounts listed in the user report have a “No” in the “PswdExpires” column, then this is a finding. Note: The following command can be used on Windows 2003/2008 Active Directory if DumpSec cannot be run: Open a Command Prompt. Enter “Dsquery user -limit 0 | Dsget user -dn -pwdneverexpires”. This will return a list of User Accounts with Yes/No for Pwdneverexpires. If any accounts have "Yes", then this is a finding. The results can be directed to a text file by adding “> filename.txt” at the end of the command The following are exempt from this requirement: Built-in Administrator Account Application Accounts Documentable Explanation: Accounts that meet the requirements for allowable exceptions should be documented with the IAO. |
Fix Text (F-6527r1_fix) |
---|
Configure all information systems to expire passwords. |