Ensure 'Relax minimum password length limits' is set to 'Enabled'

ÉlevéeNiveau 1Automatiséewindows

Description

This policy setting determines whether the minimum password length setting can be increased beyond the legacy limit of 14 characters. For more information, please see the following Microsoft Security Blog. The recommended state for this setting is: Enabled. Note: This setting only affects local accounts on the computer. Domain accounts are only affected by settings on the Domain Controllers, because that is where domain accounts are stored.

Méthode de vérification

Méthode d'audit: Registre Windows

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SAM' -Name 'RelaxMinimumPasswordLengthLimits' -ErrorAction SilentlyContinue).'RelaxMinimumPasswordLengthLimits'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'RelaxMinimumPasswordLengthLimits=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Commande shell

shell

if (-not (Test-Path 'Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SAM')) { New-Item -Path 'Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SAM' -Force | Out-Null }; New-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SAM' -Name 'RelaxMinimumPasswordLengthLimits' -Value 1 -PropertyType DWord -Force | Out-Null

Propriétés

Systèmes d'exploitation: windows-10
Étiquettes: cis-convertedregistrywindows
Référence: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 1.1.6

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target windows