DoD information system access does not require the use of a password.

From Windows 7 Security Technical Implementation Guide

Associated with: CCI-000764

SV-25210r1_rule DoD information system access does not require the use of a password.

Vulnerability discussion

The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources within the same administrative domain.

Check content

Using the DUMPSEC utility: Select “Dump Users as Table” from the “Report” menu. Select the available fields in the following sequence, and click on the “Add” button for each entry: UserName SID PswdRequired PswdExpires LastLogonTime AcctDisabled Groups If any accounts listed in the user report have a “No” in the “PswdRequired” column, then this is a finding. Note: Some built-in or application-generated accounts (e.g., Guest, IWAM_, IUSR, etc.) will not have this flag set, even though there are passwords present. It can be set by entering the following on a command line: “Net user /passwordreq:yes”. Severity Override: For a DISABLED account(s) with a blank or null password, classify/downgrade this finding to a Category 2 finding.

Fix text

Configure all DoD information systems to require passwords to gain access. The password required flag can be set by entering the following on a command line: “Net user /passwordreq:yes”.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.