Detections
Analytics
WN11-SO-000280 - Passwords for enabled local Administrator accounts must be changed at least every 60 days.
Information
The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password may not be changed as frequently as necessary. Changing the password for enabled Administrator accounts on a regular basis will limit their exposure.Windows LAPS must be used to change the built-in Administrator account password. Operational limitations preventing the use of Windows Local Administrator Password Solution (LAPS) must be approved by the authorizing official (AO).
Solution
Change the enabled local Administrator account password at least every 60 days.Windows LAPS must be used to change the built-in Administrator account password. Domain-joined and nondomain-joined systems can configure this to occur more frequently. LAPS will change the password every 30 days by default.
Operational limitations preventing the use of LAPS must be approved by the AO.
More information is available at:
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/by-popular-demand-windows-laps-available-now/ba-p/3788747
https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview#windows-laps-supported-platforms-and-azure-ad-laps-preview-status
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R9_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows 11 STIG v2r9
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1)(d), CAT|II, CCI|CCI-000199, CCI|CCI-004066, Rule-ID|SV-253476r1210304_rule, STIG-ID|WN11-SO-000280, Vuln-ID|V-253476
Plugin: Windows
Control ID: 9aad9c226772b883b6533726b0e3efcdf676b1fe019288b1a3aaadad093e1e47