Detections
Analytics
WN25-SO-000100 - Windows Server 2025 maximum age for machine account passwords must be configured to 30 days or less.
Information
Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This must be set to no more than 30 days, ensuring the machine changes its password monthly.Solution
This is the default configuration for this setting (30 days).Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> Domain member: Maximum machine account password age to '30' or less (excluding '0', which is unacceptable).
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R1_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows Server 2025 STIG v1r1
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-278204r1182319_rule, STIG-ID|WN25-SO-000100, Vuln-ID|V-278204
Plugin: Windows
Control ID: 3c69c953a544d63ae0122e51458a1ac5114c4249f7c63e97cc1d1145795fb67a