Detections
Analytics
WG060 W22 - The service account used to run the web service must have its password changed at least annually.
Information
Normally, a service account is established for the web service to run under rather than permitting it to run as part of the local system. The password on such accounts must be changed at least annually. If the password is not changed periodically, the potential for a malicious party to gain access to the web services account is greatly enhanced.NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Ensure that the service account IDs used to run the web server and sites are documented and have their passwords changed at least annually.See Also
https://iasecontent.disa.mil/stigs/zip/U_Apache_2-2_WIN_V1R13_STIG.zip
Item Details
Audit Name: DISA STIG Apache Server 2.2 Windows v1r13
References: CAT|II, Rule-ID|SV-36489r4_rule, STIG-ID|WG060_W22, Vuln-ID|V-2235
Plugin: Windows
Control ID: 707b9b6718089f30a78569cd289bbe378e35a213aa8ebc86be4f25093ed0a3a5