Local accounts must require passwords.

From Windows 8/8.1 Security Technical Implementation Guide

Associated with: CCI-000764

SV-48163r1_rule Local accounts must require passwords.

Vulnerability discussion

The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Local accounts on a system must require passwords.

Check content

Verify all local accounts require passwords. Run the DUMPSEC utility. Select "Dump Users as Table" from the "Report" menu. Select the following fields, and click "Add" for each entry. UserName SID PswdRequired AcctDisabled Groups If any accounts have "No" in the "PswdRequired" column, this is a finding. Some built-in or application-generated accounts (e.g., Guest, IWAM_, IUSR, etc.) may not have this flag set, even though there are passwords present. It can be set by entering the following on a command line: "Net user /passwordreq:yes".

Fix text

Ensure all local accounts are configured to require passwords to gain access. The password required flag can be set by entering the following on a command line: "Net user /passwordreq:yes".

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.