STIGQter: STIG Summary: Microsoft Windows Server 2022 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Windows Server 2022 must automatically remove or disable temporary user accounts after 72 hours.

DISA Rule

SV-254267r958364_rule

Vulnerability Number

V-254267

Group Title

SRG-OS-000002-GPOS-00002

Rule Version

WN22-00-000300

Severity

CAT II

CCI(s)

• CCI-000016 - Automatically remove or disable temporary and emergency accounts after an organization-defined time-period for each type of account.

Weight

10

Fix Recommendation

Configure temporary user accounts to automatically expire within 72 hours.

Domain accounts can be configured with an account expiration date, under "Account" properties.

Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where [username] is the name of the temporary user account.

Delete any temporary user accounts that are no longer necessary.

Check Contents

Review temporary user accounts for expiration dates.

Determine if temporary user accounts are used and identify any that exist. If none exist, this is NA.

Domain Controllers:

Open "PowerShell".

Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate".

If "AccountExpirationDate" has not been defined within 72 hours for any temporary user account, this is a finding.

Member servers and standalone or nondomain-joined systems:

Open "Command Prompt".

Run "Net user [username]", where [username] is the name of the temporary user account.

If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding.

Vulnerability Number

V-254267

Documentable

False

Rule Version

WN22-00-000300

Severity Override Guidance

Review temporary user accounts for expiration dates.

Determine if temporary user accounts are used and identify any that exist. If none exist, this is NA.

Domain Controllers:

Open "PowerShell".

Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate".

If "AccountExpirationDate" has not been defined within 72 hours for any temporary user account, this is a finding.

Member servers and standalone or nondomain-joined systems:

Open "Command Prompt".

Run "Net user [username]", where [username] is the name of the temporary user account.

If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding.

Check Content Reference

M

Target Key

5485