Detections
Analytics

1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled' (MS only)

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines whether the built-in Administrator account is subject to the following Account Lockout Policy settings: Account lockout duration, Account lockout threshold, and Reset account lockout counter. By default, this account is excluded from the account lockout controls and will never be locked out with repeated bad password attempts.

The recommended state for this setting is: Enabled.

Note: This setting applies only to OSes patched as of October 11, 2022 (see MS KB5020282 https://support.microsoft.com/en-us/topic/kb5020282-account-lockout-available-for-built-in-local-administrators-bce45c4d-f28d-43ad-b6fe-70156cb2dc00).

Enabling account lockout policies for the built-in Administrator account will reduce the likelihood of a successful brute force attack.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled :

Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policies\Allow Administrator account lockout

Impact:

The built-in Administrator account will be subject to the policies in Section 1.2 Account Lockout Policy of this benchmark.

See Also

https://workbench.cisecurity.org/benchmarks/25708

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7, 800-53|AC-19, CSCv7|16.11, CSCv7|16.12

Plugin: Windows

Control ID: 28258647f51a09ad72eb3019d209dff17f912dd59f5f7d57f835de4cfe1ba4b4