1

My project is implementing The CIS Critical Security Controls, Version 6.1 Can anyone please give me some advice on how we can address sub-control 16.10 which says.....

"Profile each user’s typical account usage by determining normal time-of-day access and access duration. Reports should be generated that indicate users who have logged in during unusual hours or have exceeded their normal login duration. This includes flagging the use of the user’s credentials from a computer other than computers on which the user generally works."

Is there any way to add such user access constraints as day names, date range, time of day and access duration to a Windows O/S and report when attempts are made to use the user account outside these constraints?

1

Is there any way to add such user access constraints as day names, date range, time of day and access duration to a Windows O/S

Days names and times of day can be controlled using the Logon Hours attribute of Active Directory. You can set it manually, on one or on a selection of users, or you can use a script to automate the process. You'll also need to Force logoff when logon hours expire to actually force them off at the end of their time.

As for logon duration, it's possible for you to calculate it from the logs, but not to configure a maximum in Active Directory or Windows. (That's not completely true. With Microsoft Live Family accounts, for example, you can impose both time-of-day and duration limitations on your children if they're under 18. I haven't seen that feature show up in corporate Windows, however, probably due to the lack of children in most corporations.)

report when attempts are made to use the user account outside these constraints?

You can extract this information from logs (if you're using a SIEM, you should be able to make it alert or report). For example, Windows Event ID 4625 ("An account failed to log on") entries with Status = 0xC000006F mean "User logon outside authorized hours."

  • Thank you for your comprehensive and helpful solution. – Joe Oct 31 '18 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.