Application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.

From Windows 8/8.1 Security Technical Implementation Guide

Part of WIN00-000010-02

Associated with IA controls: IAIA-1

Associated with: CCI-000366

SV-48279r2_rule Application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.

Vulnerability discussion

Setting application accounts to expire may cause applications to stop functioning. The site will have a policy that application account passwords are changed at least annually or when a system administrator with knowledge of the password leaves the organization.

Check content

The site must have a policy to ensure passwords for manually managed application/service accounts are changed at least annually or whenever a system administrator that has knowledge of the password leaves the organization. If such a policy does not exist or has not been implemented, this is a finding. Run the DUMPSEC utility. Select "Dump Users as Table" from the "Report" menu. Select the following fields, and click "Add" for each entry. UserName SID PwsdLastSetTime AcctDisabled If any application accounts listed have a date older than one year in the "PwsdLastSetTime" column, this is a finding.

Fix text

Establish a site policy that defines the requirements for application/service account password changes. Change application/service account passwords that are manually managed and entered by a system administrator at least annually or whenever an administrator with knowledge of the password leaves the organization.

Pro Tips

Powered by sagemincer