Navigate

Check: WN11-00-000090

Microsoft Windows 11 STIG: WN11-00-000090 (in versions v2 r2 through v1 r1)

Title

Accounts must be configured to require password expiration. (Cat II impact)

Discussion

Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.

Check Content

Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. Double-click each active account. If "Password never expires" is selected for any account, this is a finding.

Fix Text

Configure all passwords to expire. Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. Double-click each active account. Ensure "Password never expires" is not checked on all active accounts.

Additional Identifiers

Rule ID: SV-253273r1016425_rule

Vulnerability ID: V-253273

Group Title: SRG-OS-000076-GPOS-00044

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000199	The information system enforces maximum password lifetime restrictions.
CCI-004066	For password-based authentication, enforce organization-defined composition and complexity rules.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
IA-5(1)	Password-based Authentication