Navigate

Check: WN12-SO-000066

Microsoft Windows Server 2012/2012 R2 Domain Controller STIG: WN12-SO-000066 (in versions v3 r7 through v2 r7)

Title

The system must be configured to force users to log off when their allowed logon hours expire. (Cat II impact)

Discussion

Limiting logon hours can help protect data by only allowing access during specified times. This setting controls whether or not users are forced to log off when their allowed logon hours expire. If logon hours are set for users, this must be enforced.

Check Content

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. If the value for "Network security: Force logoff when logon hours expire" is not set to "Enabled", this is a finding.

Fix Text

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Force logoff when logon hours expire" to "Enabled".

Additional Identifiers

Rule ID: SV-226329r794610_rule

Vulnerability ID: V-226329

Group Title: SRG-OS-000163-GPOS-00072

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-001133	The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
SC-10	Network Disconnect