Detections
Analytics

1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled' (MS only)

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines whether the built-in Administrator account is subject to the following Account Lockout Policy settings: Account lockout duration, Account lockout threshold, and Reset account lockout counter . By default, this account is excluded from the account lockout controls and will never be locked out with repeated bad password attempts.

The recommended state for this setting is: Enabled.

 Note: This setting applies only to OSes patched as of October 11, 2022 (see MS KB5020282 https://support.microsoft.com/en-us/topic/kb5020282-account-lockout-available-for-built-in-local-administrators-bce45c4d-f28d-43ad-b6fe-70156cb2dc00 ).

Enabling account lockout policies for the built-in Administrator account will reduce the likelihood of a successful brute force attack.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled :

 Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policies\Allow Administrator account lockout

Impact:

The built-in Administrator account will be subject to the policies in Section 1.2 Account Lockout Policy of this benchmark.

See Also

https://workbench.cisecurity.org/benchmarks/22481

Item Details

References: CSCv7|16.11, CSCv7|16.12

Plugin: Windows

Control ID: 95ffe839b4aaa107815124c9e9218c586c73a49fef8f85534d4ef79ab9f6c98c