Microsoft Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide

The Microsoft Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide (V3 R7) has 329 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

329STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R7

CurrentPublished Thu Nov 09 2023

Policy must require application account passwords be at least 15 characters in length.

Microsoft Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide

Assessment Title

Rule Text

Policy must require application account passwords be at least 15 characters in length.

Description

Discussion Text

Application/service account passwords must be of sufficient length to prevent being easily cracked. Application/service accounts that are manually managed must have passwords at least 15 characters in length.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-225247

Rule

SV-225247r569185_rule

Severity

medium

Rule Version

WN12-00-000010

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the site has a policy to ensure passwords for manually managed application/service accounts are at least 15 characters in length.  If such a policy does not exist or has not been implemented, this is a finding.

Implementation Procedure

Fix Text

Establish a site policy that requires application/service account passwords that are manually managed to be at least 15 characters in length.  Ensure the policy is enforced.

STIG check 9 of 329 in the Microsoft Windows Server 2012/2012 R2 Member Server STIG checklist

← Previous · V-225246Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.Next · V-225248 →Windows 2012/2012 R2 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.