STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Windows Server 2025 must automatically remove or disable temporary user accounts after 72 hours.

DISA Rule

SV-278013r1182261_rule

Vulnerability Number

V-278013

Group Title

SRG-OS-000002-GPOS-00002

Rule Version

WN25-00-000300

Severity

CAT II

CCI(s)

• CCI-000016 - Automatically remove or disable temporary and emergency accounts after an organization-defined time-period for each type of account.

Weight

10

Fix Recommendation

Configure temporary user accounts to automatically expire within 72 hours.

Domain accounts can be configured with an account expiration date, under "Account" properties.

Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where [username] is the name of the temporary user account.

Delete any temporary user accounts that are no longer necessary.

Check Contents

Review temporary user accounts for expiration dates.

Determine if temporary user accounts are used and identify any that exist. If none exist, this is not applicable.

Domain Controllers:

Open PowerShell.

Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate".

If "AccountExpirationDate" has not been defined within 72 hours for any temporary user account, this is a finding.

Member servers and stand-alone or nondomain-joined systems:

Open command prompt.

Run "Net user [username]", where [username] is the name of the temporary user account.

If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding.

Vulnerability Number

V-278013

Documentable

False

Rule Version

WN25-00-000300

Severity Override Guidance

Review temporary user accounts for expiration dates.

Determine if temporary user accounts are used and identify any that exist. If none exist, this is not applicable.

Domain Controllers:

Open PowerShell.

Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate".

If "AccountExpirationDate" has not been defined within 72 hours for any temporary user account, this is a finding.

Member servers and stand-alone or nondomain-joined systems:

Open command prompt.

Run "Net user [username]", where [username] is the name of the temporary user account.

If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding.

Check Content Reference

M

Target Key

5719