Accounts Using Old Passwords

To mitigate the risk of credential theft, the passwords of all active accounts in Active Directory, including computer accounts, should be renewed regularly. However, if users must change their passwords too frequently, this may lead to the selection of predictable passwords or the storage of passwords in unsafe locations, increasing the likelihood of credential theft.

Tenable recommends implementing a password renewal policy for accounts with sensitive access rights in the information system. Configure this policy to prevent users from changing their password too frequently, which could increase the likelihood of predictable password use.

Name: Accounts Using Old Passwords

Codename: C-USER-PASSWORD

Severity: Medium

Type: Active Directory Indicator of Exposure

Family: Authentication and Credentials