Title

Application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization. (Cat II impact)

Discussion

Setting application accounts to expire may cause applications to stop functioning. The site will have a policy that application account passwords are changed at least annually or when a system administrator with knowledge of the password leaves the organization.

Check Content

The site must have a policy to ensure passwords for manually managed application/service accounts are changed at least annually or whenever a system administrator that has knowledge of the password leaves the organization. If such a policy does not exist or has not been implemented, this is a finding. Run the DUMPSEC utility. Select "Dump Users as Table" from the "Report" menu. Select the following fields, and click "Add" for each entry. UserName SID PwsdLastSetTime AcctDisabled If any application accounts listed have a date older than one year in the "PwsdLastSetTime" column, this is a finding.

Fix Text

Establish a site policy that defines the requirements for application/service account password changes. Change application/service account passwords that are manually managed and entered by a system administrator at least annually or whenever an administrator with knowledge of the password leaves the organization.

Additional Identifiers

Rule ID: SV-48279r2_rule

Vulnerability ID: V-36662

Group Title: WIN00-000010-02

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.