Detections
Analytics

1.207 WN11-SO-000110

Information

Unencrypted passwords must not be sent to third-party SMB Servers.

GROUP ID: V-253450
RULE ID: SV-253450r987796

Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication. Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment. Check with the vendor of the SMB server to see if there is a way to support encrypted password authentication.

Solution

Configure the policy value for

Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> 'Microsoft network client: Send unencrypted password to third-party SMB servers'

to 'Disabled'.

See Also

https://workbench.cisecurity.org/benchmarks/27756

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CCI|CCI-000197, Rule-ID|SV-253450r987796_rule, STIG-ID|WN11-SO-000110, Vuln-ID|V-253450

Plugin: Windows

Control ID: c9f10fd6a30e04f90d0e736eda32ee20abe9e1dc6e8b36fe02472fa0ffa7d372