System mechanisms must be implemented to enforce automatic expiration of passwords.

From Windows 7 Security Technical Implementation Guide

Associated with: CCI-000199

SV-25211r2_rule System mechanisms must be implemented to enforce automatic expiration of passwords.

Vulnerability discussion

Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.

Check content

Run the DUMPSEC utility. Select "Dump Users as Table" from the "Report" menu. Select the following fields, and click "Add" for each entry. UserName SID PswdExpires AcctDisabled Groups If any accounts have "No" in the "PswdExpires" column, this is a finding. The following are exempt from this requirement: Built-in Administrator Account Application Accounts Accounts that meet the requirements for allowable exceptions must be documented with the ISSO.

Fix text

Configure all passwords to expire. Ensure "Password never expires" is not checked on all accounts in Computer Management, Local Users and Groups. Document any exceptions with the ISSO.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.