Application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-36662	WN08-00-000010-02	SV-48279r2_rule	IAIA-1	Medium

Description
Setting application accounts to expire may cause applications to stop functioning. The site will have a policy that application account passwords are changed at least annually or when a system administrator with knowledge of the password leaves the organization.

STIG	Date
Windows 8/8.1 Security Technical Implementation Guide	2017-05-17

Details

Check Text ( C-44957r1_chk )
The site must have a policy to ensure passwords for manually managed application/service accounts are changed at least annually or whenever a system administrator that has knowledge of the password leaves the organization. If such a policy does not exist or has not been implemented, this is a finding. Run the DUMPSEC utility. Select "Dump Users as Table" from the "Report" menu. Select the following fields, and click "Add" for each entry. UserName SID PwsdLastSetTime AcctDisabled If any application accounts listed have a date older than one year in the "PwsdLastSetTime" column, this is a finding.

Check Text ( C-44957r1_chk )

The site must have a policy to ensure passwords for manually managed application/service accounts are changed at least annually or whenever a system administrator that has knowledge of the password leaves the organization. If such a policy does not exist or has not been implemented, this is a finding.

Run the DUMPSEC utility.
Select "Dump Users as Table" from the "Report" menu.
Select the following fields, and click "Add" for each entry.

UserName
SID
PwsdLastSetTime
AcctDisabled

If any application accounts listed have a date older than one year in the "PwsdLastSetTime" column, this is a finding.

Fix Text (F-41414r1_fix)
Establish a site policy that defines the requirements for application/service account password changes. Change application/service account passwords that are manually managed and entered by a system administrator at least annually or whenever an administrator with knowledge of the password leaves the organization.