Detections
Analytics
2.3.6.4 Ensure 'Domain member: Disable machine account password changes' is set to 'Disabled'
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
This policy setting determines whether a domain member can periodically change its computer account password. Computers that cannot automatically change their account passwords are potentially vulnerable, because an attacker might be able to determine the password for the system's domain account.The recommended state for this setting is: Disabled.
Note: Some problems can occur as a result of machine account password expiration, particularly if a machine is reverted to a previous point-in-time state, as is common with virtual machines. Depending on how far back the reversion is, the older machine account password stored on the machine may no longer be recognized by the domain controllers, and therefore the computer loses its domain trust. This can also disrupt non-persistent VDI implementations, and devices with write filters that disallow permanent changes to the OS volume. Some organizations may choose to exempt themselves from this recommendation and disable machine account password expiration for these situations.
Rationale:
The default configuration for Windows Server 2003-based computers that belong to a domain is that they are automatically required to change the passwords for their accounts every 30 days. If you disable this policy setting, computers that run Windows Server 2003 will retain the same passwords as their computer accounts. Computers that are no longer able to automatically change their account password are at risk from an attacker who could determine the password for the computer's domain account.
Impact:
None - this is the default behavior.
Solution
To establish the recommended configuration via GP, set the following UI path to Disabled:Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Domain member: Disable machine account password changes
Default Value:
Disabled. (The domain member can change its computer account password as specified by the Domain Member: Maximum machine account password age setting (Rule 2.3.6.5), which by default is every 30 days.)
Additional Information:
Microsoft Windows Server 2019 Security Technical Implementation Guide:
Version 2, Release 1, Benchmark Date: November 13, 2020
Vul ID: V-205815
Rule ID: SV-205815r569188_rule
STIG ID: WN19-SO-000090
Severity: CAT II
See Also
Item Details
References: CSCv7|5.1
Plugin: Windows
Control ID: b2c365552f52fea91d9200c08b1372fb15a17b68f3f92c7040b6b871b0dd289f