Windows service \ application accounts with administrative privileges and manually managed passwords, must have passwords changed at least every 60 days.
An XCCDF Rule
Description
<VulnDiscussion>NT hashes of passwords for accounts that are not changed regularly are susceptible to reuse by attackers using Pass-the-Hash. Windows service \ application account passwords are not typically changed for longer periods of time to ensure availability of the applications. If a service \ application also has administrative privileges it will provide elevated access if compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-243474r723457_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
If no Windows service \ application accounts with manually managed passwords have administrative privileges, this is NA.
Change passwords for Windows service \ application accounts with administrative privileges and manually managed passwords, at least every 60 days.