Windows 7 Security Technical Implementation Guide

The Windows 7 Security Technical Implementation Guide (V1 R32) has 296 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

296STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R32

CurrentPublished Wed Jun 17 2020

Windows 7 account lockout duration must be configured to 15 minutes or greater.

Windows 7 Security Technical Implementation Guide

Assessment Title

Rule Text

Windows 7 account lockout duration must be configured to 15 minutes or greater.

Description

Discussion Text

The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the amount of time that an account will remain locked after the specified number of failed logon attempts.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-1099

Rule

SV-25014r3_rule

Severity

medium

Rule Version

4.004

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Analyze the system using the Security Configuration and Analysis snap-in.
Expand the Security Configuration and Analysis tree view.
Navigate to Account Policies >> Account Lockout Policy.

If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding.

Configuring this to "0", requiring an administrator to unlock the account, is more restrictive and is not a finding.

Implementation Procedure

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout duration" to "15" minutes or greater.

A value of "0" is also acceptable, requiring an administrator to unlock the account.

STIG check 17 of 296 in the Windows 7 STIG checklist

← Previous · V-1098The reset period for the account lockout counter must be configured to 15 minutes or greater on Windows 7.Next · V-1102 →The Act as part of the operating system user right must be granted to no accounts.