Caching of logon credentials must be limited.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-1090	WN08-SO-000024	SV-48023r1_rule	ECSC-1	Low

Description
The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well-protected, storing encrypted copies of users' passwords on workstations does not always have the same physical protection required for domain controllers. If a workstation is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.

Description

The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well-protected, storing encrypted copies of users' passwords on workstations does not always have the same physical protection required for domain controllers. If a workstation is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.

STIG	Date
Windows 8 / 8.1 Security Technical Implementation Guide	2014-12-13

Details

Check Text ( None )
None

Fix Text (F-41161r1_fix)
Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Number of previous logons to cache (in case Domain Controller is not available)" to "4" logons or less.