Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-1112 | WN12-GE-000014 | SV-52854r1_rule | IAAC-1 | Low |
Description |
---|
Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disabled until needed. |
STIG | Date |
---|---|
Windows Server 2012 / 2012 R2 Domain Controller Security Technical Implementation Guide | 2014-12-18 |
Check Text ( C-47171r2_chk ) |
---|
Run the DUMPSEC utility. Select "Dump Users as Table" from the "Report" menu. Select the following fields, and click "Add" for each entry: UserName SID LastLogonTime AcctDisabled Review the "LastLogonTime". If any enabled accounts have not been logged into within the past 35 days, this is a finding. The following accounts are exempt: Built-in administrator account (SID ending in 500) Built-in guest account (SID ending in 501) Application accounts Disabled accounts The following PowerShell command may be used on domain controllers to list inactive accounts: Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00 Review the list to determine the validity for each account reported. |
Fix Text (F-45780r1_fix) |
---|
Regularly review accounts to determine if they are still active. Remove or disable accounts that have not been used in the last 35 days. |