Windows Vista Security Technical Implementation Guide

The Windows Vista Security Technical Implementation Guide (V6 R42) has 251 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

251STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V6 · R42

CurrentPublished Fri Apr 28 2017

Outdated or unused accounts must be removed from the system.

Windows Vista Security Technical Implementation Guide

Assessment Title

Rule Text

Outdated or unused accounts must be removed from the system.

Description

Discussion Text

Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disable until needed.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-1112

Rule

SV-29481r2_rule

Severity

low

Rule Version

4.019

Documentable

true

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Run the DUMPSEC utility.
Select "Dump Users as Table" from the "Report" menu.
Select the following fields, and click "Add" for each entry:

UserName
SID
LastLogonTime
AcctDisabled

Review the "LastLogonTime".
If any enabled accounts have not been logged on to within the past 35 days, this is a finding.

The following accounts are exempt:
Built-in administrator account (SID ending in 500)
Built-in guest account (SID ending in 501)
Application accounts
Disabled accounts

Review the list to determine the finding validity for each account reported.

If the organization has a need for special purpose local user accounts such as a backup administrator account (see V-14224), this must be documented with the ISSO.  This would not be a finding.

Implementation Procedure

Fix Text

Regularly review accounts to determine if they are still active.  Accounts that have not been used in the last 35 days must be removed or disabled.

STIG check 22 of 251 in the Windows Vista STIG checklist

← Previous · V-1107The password history must be configured to 24 passwords remembered.Next · V-1113 →The built-in guest account is not disabled.