Ensure 'Store passwords using reversible encryption' is set to 'Disabled'

HighLevel 1Automatedwindows

Description

This policy setting determines whether the operating system stores passwords in a way that uses reversible encryption, which provides support for application protocols that require knowledge of the user's password for authentication purposes. Passwords that are stored with reversible encryption are essentially the same as plaintext versions of the passwords. The recommended state for this setting is: Disabled. Note: Password Policy settings (section 1.1) and Account Lockout Policy settings (section 1.2) must be applied via the Default Domain Policy GPO in order to be globally in effect on doma

How it is checked

Audit method: Shell command

shell

$f = Join-Path $env:TEMP ('tmaegis-' + [guid]::NewGuid().ToString() + '.inf'); secedit /export /cfg $f /areas SECURITYPOLICY USER_RIGHTS /quiet | Out-Null; $c = Get-Content $f -ErrorAction SilentlyContinue; Remove-Item $f -Force -ErrorAction SilentlyContinue; $line = $c | Where-Object { $_ -match '^\s*ClearTextPassword\s*=' } | Select-Object -First 1; $v = if ($line) { ($line -split '=', 2)[1].Trim().Trim('"') } else { $null }; if (($null -ne $v -and [int64]$v -eq 0)) { 'compliant' } else { 'non-compliant: ' + $v }

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Set through Group Policy (domain policy for domain members): Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Store passwords using reversible encryption

Properties

Operating systems: windows-10
Tags: cis-convertedseceditwindows
Reference: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 1.1.7

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target windows