UCF STIG Viewer Logo

Application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.


Overview

Finding ID Version Rule ID IA Controls Severity
V-36662 WN08-00-000010-02 SV-48279r2_rule IAIA-1 Medium
Description
Setting application accounts to expire may cause applications to stop functioning. The site will have a policy that application account passwords are changed at least annually or when a system administrator with knowledge of the password leaves the organization.
STIG Date
Windows 8/8.1 Security Technical Implementation Guide 2018-02-12

Details

Check Text ( C-44957r1_chk )
The site must have a policy to ensure passwords for manually managed application/service accounts are changed at least annually or whenever a system administrator that has knowledge of the password leaves the organization. If such a policy does not exist or has not been implemented, this is a finding.

Run the DUMPSEC utility.
Select "Dump Users as Table" from the "Report" menu.
Select the following fields, and click "Add" for each entry.

UserName
SID
PwsdLastSetTime
AcctDisabled

If any application accounts listed have a date older than one year in the "PwsdLastSetTime" column, this is a finding.
Fix Text (F-41414r1_fix)
Establish a site policy that defines the requirements for application/service account password changes.

Change application/service account passwords that are manually managed and entered by a system administrator at least annually or whenever an administrator with knowledge of the password leaves the organization.