STIGQter: STIG Summary: AvePoint Fly Server Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

Fly Server must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period.

DISA Rule

SV-283926r1206132_rule

Vulnerability Number

V-283926

Group Title

SRG-APP-000065

Rule Version

FLYS-00-000020

Severity

CAT II

CCI(s)

• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
• CCI-002238 - Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.
• CCI-002361 - Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.
• CCI-004045 - Require users to be individually authenticated before granting access to the shared accounts or resources.

Weight

10

Fix Recommendation

Configure the logon configuration in Fly Server Manager:
- Access the VM or server where the Fly Server manager is installed.
- Find the installation location of Fly Server manager.
- Open the "TimerService.exe.config" file in ...\APElements\FLY\Manager\Control\bin.
- Find following node and set the value to "3":

<add key="FailedLogOnLimitationCount" value="3" />

Check Contents

Check the logon configuration in Fly Server Manager:
- Access the VM or server where the Fly Server manager is installed.
- Find the installation location of Fly Server manager.
- Open the "TimerService.exe.config" file in ...\APElements\FLY\Manager\Control\bin.
- Check the key "FailedLogOnLimitationCount".

If the value is not "3", this is a finding.

Vulnerability Number

V-283926

Documentable

False

Rule Version

FLYS-00-000020

Severity Override Guidance

Check the logon configuration in Fly Server Manager:
- Access the VM or server where the Fly Server manager is installed.
- Find the installation location of Fly Server manager.
- Open the "TimerService.exe.config" file in ...\APElements\FLY\Manager\Control\bin.
- Check the key "FailedLogOnLimitationCount".

If the value is not "3", this is a finding.

Check Content Reference

M

Target Key

5747