CIS Microsoft Windows 10 Enterprise Release 1909 Benchmark

Audit:

Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft Services\AdmPwd:PasswordLength

Remediation:

To establish the recommended configuration via GP, set the following UI path to Enabled , and configure the Password Length optionto 15 or more :

Computer Configuration\Policies\Administrative Templates\LAPS\Password Settings

Note: This Group Policy path does not exist by default. An additional Group Policy template ( AdmPwd.admx/adml ) isrequired - it is included with Microsoft Local Administrator Password Solution (LAPS).

Impact:

LAPS-generated passwords will be required to have a length of 15 characters (or more, if selected).

Default Value:

14 characters.

CIS Controls:

Version 6

5.7 User Accounts Shall Use Long Passwords Where multi-factor authentication is not supported, user accounts shall be required to use long passwords on the system (longer than 14 characters).

Version 7

16.2 Configure Centralized Point of Authentication Configure access for all accounts through as few centralized points of authentication as possible, including network, security, and cloud systems.

522 | P a g e