STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Windows Server 2025 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.

DISA Rule

SV-278014r1182263_rule

Vulnerability Number

V-278014

Group Title

SRG-OS-000123-GPOS-00064

Rule Version

WN25-00-000310

Severity

CAT II

CCI(s)

• CCI-001682 - Automatically removes or disables emergency accounts after an organization-defined time period for each type of account.

Weight

10

Fix Recommendation

Remove emergency administrator accounts after a crisis has been resolved or configure the accounts to automatically expire within 72 hours.

Domain accounts can be configured with an account expiration date, under "Account" properties.

Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where [username] is the name of the temporary user account.

Check Contents

Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is not applicable.

If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved.

If emergency administrator accounts have not been configured with an expiration date or have not been disabled or removed following the resolution of a crisis, this is a finding.

Domain Controllers:

Open PowerShell.

Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate".

If "AccountExpirationDate" has been defined and is not within 72 hours for an emergency administrator account, this is a finding.

Member servers and stand-alone or nondomain-joined systems:

Open command prompt.

Run "Net user [username]", where [username] is the name of the emergency account.

If "Account expires" has been defined and is not within 72 hours for an emergency administrator account, this is a finding.

Vulnerability Number

V-278014

Documentable

False

Rule Version

WN25-00-000310

Severity Override Guidance

Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is not applicable.

If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved.

If emergency administrator accounts have not been configured with an expiration date or have not been disabled or removed following the resolution of a crisis, this is a finding.

Domain Controllers:

Open PowerShell.

Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate".

If "AccountExpirationDate" has been defined and is not within 72 hours for an emergency administrator account, this is a finding.

Member servers and stand-alone or nondomain-joined systems:

Open command prompt.

Run "Net user [username]", where [username] is the name of the emergency account.

If "Account expires" has been defined and is not within 72 hours for an emergency administrator account, this is a finding.

Check Content Reference

M

Target Key

5719