The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
# Windows PowerShell
# Reconstructed from oval:mil.disa.stig.windows10:def:220716
# Accounts must be configured to require password expiration.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
# No active, local accounts have non-expiring passwords.
# wmi57_object (wmi57_test)
function test_1 {
return (-not ($null -ne (Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT name FROM Win32_UserAccount WHERE LocalAccount=TRUE AND Disabled=FALSE AND PasswordExpires=FALSE')))
}
if (test_1) {
Write-Output "PASS"
} else {
Write-Output "FAIL"
} Assessment Script Powered by AISyntax-verified
A standalone PowerShell script to assess this control automatically. Review before running it in your environment.
Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_windows_10 target this check assesses.
# OVAL Definition: oval:mil.disa.stig.windows10:def:220716
$compliant = Get-CimInstance -ClassName Win32_UserAccount -Filter "LocalAccount=TRUE AND Disabled=FALSE AND PasswordExpires=FALSE".Count -eq 0
if ($compliant) { Write-Output "PASS"; Exit 0 } else { Write-Output "FAIL"; Exit 1 }