STIGQter: STIG Summary: Microsoft Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 04 May 2021: STIGQter: STIG Summary: Microsoft Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 04 May 2021:SV-225440r569185_rule
V-225440
SRG-OS-000123-GPOS-00064
WN12-GE-000057
CAT II
10
Remove emergency administrator accounts after a crisis has been resolved or configure the accounts to automatically expire within 72 hours.
Domain accounts can be configured with an account expiration date, under "Account" properties.
Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where username is the name of the emergency administrator account.
Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is NA.
If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved.
If emergency administrator accounts have not been configured with an expiration date or have not been disabled or removed following the resolution of a crisis, this is a finding.
Domain Controllers:
Enter "Search-ADAccount -AccountExpiring -TimeSpan 3:00:00:00 | FT Name, AccountExpirationDate"
This will return any accounts configured to expire within the next 3 days. (The "TimeSpan" value to can be changed to find accounts configured to expire at various times such as 30 for the next month.)
If any accounts identified as emergency administrator accounts are not listed, this is a finding.
For any emergency administrator accounts returned by the previous query:
Enter "Get-ADUser -Identity [Name] -Property WhenCreated" to determine when the account was created.
If the "WhenCreated" date and "AccountExpirationDate" from the previous query are greater than 3 days apart, this is a finding.
Member servers and standalone systems:
Enter "Net User [username]", where [username] is the name of the emergency administrator accounts.
If "Account expires" has not been defined within 72 hours for any emergency administrator accounts, this is a finding.
If the "Password last set" date and "Account expires" date are greater than 72 hours apart, this is a finding. (Net User does not provide an account creation date.)
V-225440
False
WN12-GE-000057
Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is NA.
If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved.
If emergency administrator accounts have not been configured with an expiration date or have not been disabled or removed following the resolution of a crisis, this is a finding.
Domain Controllers:
Enter "Search-ADAccount -AccountExpiring -TimeSpan 3:00:00:00 | FT Name, AccountExpirationDate"
This will return any accounts configured to expire within the next 3 days. (The "TimeSpan" value to can be changed to find accounts configured to expire at various times such as 30 for the next month.)
If any accounts identified as emergency administrator accounts are not listed, this is a finding.
For any emergency administrator accounts returned by the previous query:
Enter "Get-ADUser -Identity [Name] -Property WhenCreated" to determine when the account was created.
If the "WhenCreated" date and "AccountExpirationDate" from the previous query are greater than 3 days apart, this is a finding.
Member servers and standalone systems:
Enter "Net User [username]", where [username] is the name of the emergency administrator accounts.
If "Account expires" has not been defined within 72 hours for any emergency administrator accounts, this is a finding.
If the "Password last set" date and "Account expires" date are greater than 72 hours apart, this is a finding. (Net User does not provide an account creation date.)
M
4214