Ensure 'Minimum password length' is set to '14 or more character(s)'

AltaNivel 1Automatizadawindows

Descripción

This policy setting determines the least number of characters that make up a password for a user account. There are many different theories about how to determine the best password length for an organization, but perhaps "passphrase" is a better term than "password." In Microsoft Windows 2000 or newer, passphrases can be quite long and can include spaces. Therefore, a phrase such as "I want to drink a $5 milkshake" is a valid passphrase; it is a considerably stronger password than an 8 or 10 character string of random numbers and letters, and yet is easier to remember. Users must be educated a

Cómo se verifica

Método de auditoría: Comando de shell

shell

$f = Join-Path $env:TEMP ('tmaegis-' + [guid]::NewGuid().ToString() + '.inf'); secedit /export /cfg $f /areas SECURITYPOLICY USER_RIGHTS /quiet | Out-Null; $c = Get-Content $f -ErrorAction SilentlyContinue; Remove-Item $f -Force -ErrorAction SilentlyContinue; $line = $c | Where-Object { $_ -match '^\s*MinimumPasswordLength\s*=' } | Select-Object -First 1; $v = if ($line) { ($line -split '=', 2)[1].Trim().Trim('"') } else { $null }; if (($null -ne $v -and [int64]$v -ge 14)) { 'compliant' } else { 'non-compliant: ' + $v }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set through Group Policy (domain policy for domain members): Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Minimum password length

Propiedades

Sistemas operativos: windows-10
Etiquetas: cis-convertedseceditwindows
Referencia: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 1.1.4

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target windows