Detections
Analytics
18.2.4 Ensure 'Password Settings: Password Complexity' is set to 'Enabled: Large letters + small letters + numbers + special characters'
Information
In May 2015, Microsoft released the Local Administrator Password Solution (LAPS) tool, which is free and supported software that allows an organization to automatically set randomized and unique local Administrator account passwords on domain-attached workstations and Member Servers.The passwords are stored in a confidential attribute of the domain computer account and can be retrieved from Active Directory by approved Sysadmins when needed.
The LAPS tool requires a small Active Directory Schema update in order to implement, as well as installation of a Group Policy Client Side Extension (CSE) on targeted computers.
Please see the LAPS documentation for details.
LAPS supports Windows Vista or newer workstation OSes, and Server 2003 or newer server OSes.
LAPS does not support standalone computers - they must be joined to a domain.
The recommended state for this setting is: 'Enabled: Large letters + small letters + numbers + special characters'.
Note: Organizations that utilize 3rd-party commercial software to manage unique & complex local Administrator passwords on domain members may opt to disregard these LAPS recommendations.
'Note #2:' LAPS is only designed to manage _local_ Administrator passwords, and is therefore not recommended (or supported) for use directly on Domain Controllers, which do not have a traditional local Administrator account.
We strongly encourage you to only deploy the LAPS CSE and LAPS GPO settings to member servers and workstations.
Rationale:
Due to the difficulty in managing local Administrator passwords, many organizations choose to use the same password on all workstations and/or Member Servers when deploying them.
This creates a serious attack surface security risk because if an attacker manages to compromise one system and learn the password to its local Administrator account, then they can leverage that account to instantly gain access to all other computers that also use that password for their local Administrator account.
Solution
To establish the recommended configuration via GP, set the following UI path to 'Enabled', and configure the 'Password Complexity' option to 'Large letters + small letters + numbers + special characters':Computer Configuration\Policies\Administrative Templates\LAPS\Password Settings
Note: This Group Policy path does not exist by default.
An additional Group Policy template ('AdmPwd.admx/adml') is required - it is included with Microsoft Local Administrator Password Solution (LAPS).
Impact:
LAPS-generated passwords will be required to contain large letters + small letters + numbers + special characters.
See Also
Item Details
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1), CSCv6|5.7
Plugin: Windows
Control ID: f78bbdf35edf56164c97e63b86a6af9760f31c381b2fbf5ca94c545bc2482067