3.9 Ensure 'INACTIVE_ACCOUNT_TIME' Is Less than or Equal to '120'

Information

The INACTIVE_ACCOUNT_TIME setting determines the maximum number of days of inactivity (no logins at all) after which the account will be locked. The suggested value for this is 120 or less.

Rationale:

Setting INACTIVE_ACCOUNT_TIME can help with deactivation of 'inactive' or 'unused' accounts.

Solution

To remediate this setting, execute the following SQL statement for each PROFILE returned by the audit procedure.

ALTER PROFILE <profile_name> LIMIT INACTIVE_ACCOUNT_TIME 120;

See Also

https://workbench.cisecurity.org/files/4252