Detections
Analytics
WN11-SO-000195 - The system must be configured to prevent the storage of the LAN Manager hash of passwords.
Information
The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.Solution
Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> 'Network security: Do not store LAN Manager hash value on next password change' to 'Enabled'.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R7_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows 11 STIG v2r7
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1)(c), CAT|I, CCI|CCI-000196, CCI|CCI-004062, Rule-ID|SV-253461r1051056_rule, STIG-ID|WN11-SO-000195, Vuln-ID|V-253461
Plugin: Windows
Control ID: 78c147cbd964fde6f2cb1c5e08f12c7095b528e6cb099f36c92fec27f939f2de