Detections
Analytics
WN11-CC-000260 - Windows 11 must be configured to require a minimum PIN length of six characters or greater.
Information
Windows allows the use of PINs and biometrics for authentication without sending a password to a network or website where it could be compromised. Longer minimum PIN lengths increase the available combinations an attacker would have to attempt. Shorter minimum length significantly reduces the strength.Note: A different registry location is needed when systems are managed by Intune versus GPO.
Solution
For GPO-managed systems:Configure the policy value for Computer Configuration >> Administrative Templates >> System >> PIN Complexity >> 'Minimum PIN length' to '6' or greater.
For Intune-managed systems:
Revise the Intune policy to set the minimum PIN length to '6' or greater.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R9_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows 11 STIG v2r9
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-253401r1210296_rule, STIG-ID|WN11-CC-000260, Vuln-ID|V-253401
Plugin: Windows
Control ID: ba9d365a7216f32201ea3c0d216656227fc6013f6a65702f2d867d313f099fb6