[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CCE
view XML

CCE-21427-0

Platform: cpe:/o:microsoft:windows_8Date: (C)2014-05-14   (M)2023-07-04



Configure use of passwords for operating system drives This policy setting specifies the constraints for passwords used to unlock BitLocker-protected operating system drives. If non-TPM protectors are allowed on operating system drives, you can provision a password, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective the Group Policy setting 'Password must meet complexity requirements' located in Computer ConfigurationWindows SettingsSecurity SettingsAccount PoliciesPassword Policy must be also enabled. Note: These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker will allow unlocking a drive with any of the protectors available on the drive. If you enable this policy setting, users can configure a password that meets the requirements you define. To enforce complexity requirements on the password, select 'Require complexity'. When set to 'Require complexity' a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to 'Allow complexity' a connection to a domain controller will be attempted to validate the complexity adheres to the rules set by the policy, but if no domain controllers are found the password will still be accepted regardless of actual password complexity and the drive will be encrypted using that password as a protector. When set to 'Do not allow complexity', no password complexity validation will be done. Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the 'Minimum password length' box. If you disable or do not configure this policy setting, the default length constraint of 8 characters will apply to operating system drive passwords and no complexity checks will occur. Note: Passwords cannot be used if FIPS-compliance is enabled. The 'System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing' policy setting in Computer ConfigurationWindows SettingsSecurity SettingsLocal PoliciesSecurity Options specifies whether FIPS-compliance is enabled.


Parameter:

[true/false, true/false]


Technical Mechanism:

(1) GPO: Computer ConfigurationAdministrative TemplatesWindows ComponentsBitLocker Drive EncryptionOperating System Drives!Configure use of passwords for operating system drives (2) REG: HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftFVE!OSPassphrase

CCSS Severity:CCSS Metrics:
CCSS Score : 7.3Attack Vector: LOCAL
Exploit Score: 1.8Attack Complexity: LOW
Impact Score: 5.5Privileges Required: LOW
Severity: HIGHUser Interaction: NONE
Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LScope: UNCHANGED
 Confidentiality: HIGH
 Integrity: HIGH
 Availability: LOW
  

References:
Resource IdReference
SCAP Repo OVAL Definitionoval:org.secpod.oval:def:13812


OVAL    1
oval:org.secpod.oval:def:13812
XCCDF    1
xccdf_org.secpod_benchmark_general_Windows_8

© SecPod Technologies