| Review the password required status for enabled user accounts. |
Enter "Get-Aduser -Filter * -Properties Passwordnotrequired |FT Name, Passwordnotrequired, Enabled".
Exclude disabled accounts (e.g., DefaultAccount, Guest) and Trusted Domain Objects (TDOs).
If "Passwordnotrequired" is "True" or blank for any enabled user account, this is a finding.
Member servers and standalone systems:
Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordRequired=False and LocalAccount=True" | FT Name, PasswordRequired, Disabled, LocalAccount'.
Exclude disabled accounts (e.g., DefaultAccount, Guest).
If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding.