Windows 2008 Domain Controller Security Technical Implementation Guide

The Windows 2008 Domain Controller Security Technical Implementation Guide (V6 R47) has 245 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

245STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V6 · R47

CurrentPublished Wed Jun 17 2020

Maximum password age does not meet minimum requirements.

Windows 2008 Domain Controller Security Technical Implementation Guide

Assessment Title

Rule Text

Maximum password age does not meet minimum requirements.

Description

Discussion Text

The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Further, scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-1104

Rule

SV-29647r1_rule

Severity

medium

Rule Version

4.011

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Analyze the system using the Security Configuration and Analysis snap-in.
Expand the Security Configuration and Analysis tree view.
Navigate to Account Policies -> Password Policy.

If the value for the "Maximum password age" is greater than 60 days, then this is a finding.  If the value is set to 0 (never expires), then this is a finding.

Implementation Procedure

Fix Text

Configure the Maximum Password Age so that it is not "0" and doesn't exceed 60 days.

STIG check 18 of 245 in the Windows 2008 Domain Controller STIG checklist

← Previous · V-1103User rights assignments must meet minimum requirements.Next · V-1105 →Minimum password age does not meet minimum requirements.