Local users on domain-joined computers must not be enumerated.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-63633	WN10-CC-000130	SV-78123r1_rule		Medium

Description
The username is one part of logon credentials that could be used to gain access to a system. Preventing the enumeration of users limits this information to authorized personnel.

STIG	Date
Windows 10 Security Technical Implementation Guide	2016-10-28

Details

Check Text ( None )
None

Fix Text (F-69565r1_fix)
This requirement is applicable to domain-joined systems, for standalone systems this is NA. Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> "Enumerate local users on domain-joined computers" to "Disabled".