Detections
Analytics

1.1.6 Ensure 'Store passwords using reversible encryption' is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines whether the operating system stores passwords in a way that uses reversible encryption, which provides support for application protocols that require knowledge of the user's password for authentication purposes. Passwords that are stored with reversible encryption are essentially the same as plaintext versions of the passwords.

The recommended state for this setting is: Disabled.

Rationale:

Enabling this policy setting allows the operating system to store passwords in a weaker format that is much more susceptible to compromise and weakens your system security.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled:

Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Store passwords using reversible encryption

Impact:

If your organization uses either the CHAP authentication protocol through remote access or IAS services or Digest Authentication in IIS, you must configure this policy setting to Enabled. This setting is extremely dangerous to apply through Group Policy on a user-by-user basis, because it requires the appropriate user account object to be opened in Active Directory Users and Computers.


Default Value:

Disabled.

See Also

https://workbench.cisecurity.org/files/2750

Item Details

References: CSCv6|16.5, CSCv6|16.13, CSCv6|16.14, CSCv7|16.2, CSCv7|16.4, CSCv7|16.5

Plugin: Windows

Control ID: dfb3ff84c80812e6c6ffd48a9c80c78d4c89d29716357ff5188fd91f0b527f90