Detections
Analytics

4.10.26.7 (L1) Ensure 'Turn on convenience PIN sign-in' is set to 'Disabled'

Information

This policy setting allows you to control whether a user can sign in using a convenience PIN.

Note: The user's password will be cached in the system vault when using this feature.

The recommended state for this setting is: Disabled

A PIN is created from a much smaller selection of characters than a password, so in most cases a PIN will be much less robust than a password.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Disabled

Administrative Templates\System\Logon\Turn on convenience PIN sign-in

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/21719

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7

Plugin: Windows

Control ID: 043e6bf077451d199889f84e5318780ebc6d7ac74d681161443b178acc914b73