SV-25210r1: DoD information system access does not require the use of a password. | Windows 7 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

DoD information system access does not require the use of a password.

Description

Discussion Text

The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources within the same administrative domain.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000764

Additional Details

Severity Override Guidance

For a DISABLED account(s) with a blank or null password, classify/downgrade this finding to a Category 2 finding.

Responsibility

System Administrator

References

DPMS Target Windows 7 DISA DPMS Target Windows 7 1712

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.fso.windows:def:4983
# DoD information system access does not require the use of a password.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# All user accounts require passwords
# wmi_object (wmi_test)
function test_1 {
  return (-not ($null -ne (Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT caption FROM Win32_UserAccount WHERE LocalAccount=true AND PasswordRequired=false')))
}

if (test_1) {
  Write-Output "PASS"
} else {
  Write-Output "FAIL"
}

Assessment Script Powered by AISyntax-verified

A standalone PowerShell script to assess this control automatically. Review before running it in your environment.

Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual windows_7 target this check assesses.

# OVAL Definition: oval:mil.disa.fso.windows:def:4983
$compliant = $true
$users = Get-CimInstance -ClassName Win32_UserAccount -Filter "LocalAccount=true"
foreach ($user in $users) {
    if (-not $user.PasswordRequired) {
        $compliant = $false
        break
    }
}
if ($compliant) {
    Write-Output "PASS"
    exit 0
} else {
    Write-Output "FAIL"
    exit 1
}

Remediation

Configure all DoD information systems to require passwords to gain access.

				The password required flag can be set by entering the following on a command line: “Net user <account_name> /passwordreq:yes”.