Windows Server 2019 accounts must require passwords.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-205700 | WN19-00-000200 | SV-205700r958482_rule | CCI-000764 | medium |
| Description | ||||
| The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords. | ||||
| STIG | Date | |||
| Microsoft Windows Server 2019 Security Technical Implementation Guide | 2025-05-23 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
IA-2
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.5.1
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.5.2
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000764
1.00
- DISA · 3 · disa_xccdf · related
Details
Check Text (C-205700r958482_chk)
Review the password required status for enabled user accounts.
Open "PowerShell".
Domain Controllers:
Enter "Get-Aduser -Filter * -Properties Passwordnotrequired |FT Name, Passwordnotrequired, Enabled".
Exclude disabled accounts (e.g., DefaultAccount, Guest) and Trusted Domain Objects (TDOs).
If "Passwordnotrequired" is "True" or blank for any enabled user account, this is a finding.
Member servers and standalone or nondomain-joined systems:
Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordRequired=False and LocalAccount=True" | FT Name, PasswordRequired, Disabled, LocalAccount'.
Exclude disabled accounts (e.g., DefaultAccount, Guest).
If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding.
Fix Text (F-5965r355019_fix)
Configure all enabled accounts to require passwords.
The password required flag can be set by entering the following on a command line: "Net user [username] /passwordreq:yes", substituting [username] with the name of the user account.