Detections
Analytics
WN19-00-000020 - Windows Server 2019 passwords for the built-in Administrator account must be changed at least every 60 days.
Information
The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. The built-in Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for the built-in Administrator account on a regular basis will limit its exposure.Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every '30' days by default.
Solution
Change the built-in Administrator account password at least every '60' days.Automated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to accomplish this.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2019_V2R2_STIG.zip
Item Details
Audit Name: DISA Windows Server 2019 STIG v2r2
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1), CAT|II, CCI|CCI-000199, Rule-ID|SV-205657r569188_rule, STIG-ID|WN19-00-000020, STIG-Legacy|SV-103559, STIG-Legacy|V-93473, Vuln-ID|V-205657
Plugin: Windows
Control ID: 5c403c5e942e0a50840568a3a077024c4ef747aaaf4aabc904527b0ea40887d1