Title

To the extent system capabilities permit, system mechanisms are not implemented to enforce automatic expiration of passwords and to prevent reuse. (Cat II impact)

Discussion

Passwords that do not expire or are reused increase the exposure of a password with greater probability of being discovered or cracked.

Check Content

Using the DUMPSEC utility: Select “Dump Users as Table” from the “Report” menu. Select the available fields in the following sequence, and click on the “Add” button for each entry: UserName SID PswdRequired PswdExpires PswdLastSetTime LastLogonTime AcctDisabled Groups If any accounts listed in the user report have a “No” in the “PswdExpires” column, then this is a finding. Note: The following command can be used on Windows 2003/2008 Active Directory if DumpSec cannot be run: Open a Command Prompt. Enter “Dsquery user -limit 0 | Dsget user -dn -pwdneverexpires”. This will return a list of User Accounts with Yes/No for Pwdneverexpires. If any accounts have "Yes", then this is a finding. The results can be directed to a text file by adding “> filename.txt” at the end of the command The following are exempt from this requirement: Built-in Administrator Account Application Accounts Documentable Explanation: Accounts that meet the requirements for allowable exceptions should be documented with the IAO.

Fix Text

Configure all information systems to expire passwords.

Additional Identifiers

Rule ID: SV-29393r1_rule

Vulnerability ID: V-6840

Group Title: Password Expiration

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.