Detections
Analytics
WN11-CC-000260 - Windows 11 must be configured to require a minimum PIN length of six characters or greater.
Information
Windows allows the use of PINs and biometrics for authentication without sending a password to a network or website where it could be compromised. Longer minimum PIN lengths increase the available combinations an attacker would have to attempt. Shorter minimum length significantly reduces the strength.Note: A different registry location is needed when systems are managed by Intune versus GPO.
Solution
For GPO-managed systems:Configure the policy value for Computer Configuration >> Administrative Templates >> System >> PIN Complexity >> 'Minimum PIN length' to '6' or greater.
For Intune-managed systems:
Revise the Intune policy to set the minimum PIN length to '6' or greater.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R11_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows 11 STIG v2r11
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-253401r1268251_rule, STIG-ID|WN11-CC-000260, Vuln-ID|V-253401
Plugin: Windows
Control ID: 381800eef96ff532dc337ba440df3620af19ee6482cc2d744fa9156768b6c095