Local accounts must require passwords.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-7002	WN08-GE-000018	SV-48163r1_rule	IAIA-1 IAIA-2	High

Description
The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Local accounts on a system must require passwords.

STIG	Date
Windows 8 Security Technical Implementation Guide	2013-02-15

Details

Check Text ( C-44863r1_chk )
Verify all local accounts require passwords. Run the DUMPSEC utility. Select "Dump Users as Table" from the "Report" menu. Select the following fields, and click "Add" for each entry. UserName SID PswdRequired AcctDisabled Groups If any accounts have "No" in the "PswdRequired" column, this is a finding. Some built-in or application-generated accounts (e.g., Guest, IWAM_, IUSR, etc.) may not have this flag set, even though there are passwords present. It can be set by entering the following on a command line: "Net user /passwordreq:yes".

Check Text ( C-44863r1_chk )

Verify all local accounts require passwords.

Run the DUMPSEC utility.
Select "Dump Users as Table" from the "Report" menu.
Select the following fields, and click "Add" for each entry.

UserName
SID
PswdRequired
AcctDisabled
Groups

If any accounts have "No" in the "PswdRequired" column, this is a finding.

Some built-in or application-generated accounts (e.g., Guest, IWAM_, IUSR, etc.) may not have this flag set, even though there are passwords present. It can be set by entering the following on a command line: "Net user /passwordreq:yes".

Fix Text (F-41301r1_fix)
Ensure all local accounts are configured to require passwords to gain access. The password required flag can be set by entering the following on a command line: "Net user /passwordreq:yes".