Detections
Analytics

4.10.26.1 (L1) Ensure 'Block user from showing account details on sign-in' is set to 'Enabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy prevents the user from showing account details (email address or user name) on the sign-in screen.

The recommended state for this setting is: Enabled

An attacker with access to the console (for example, someone with physical access or someone who is able to connect to the workstation through Remote Desktop Services) could view the name of the last user who logged on to the server. The attacker could then try to guess the password, use a dictionary, or use a brute-force attack to try and log on.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Enabled

Administrative Templates\System\Logon\Block user from showing account details on sign-in

Impact:

Users cannot choose to show account details on the sign-in screen.

See Also

https://workbench.cisecurity.org/benchmarks/21719

Item Details

References: CSCv7|5.1

Plugin: Windows

Control ID: 495918fd6ec860417532c99f245dcc20bec4048b5b4ad2f7f64086bb7eec1449