ASD ISM 1829 Prevent password storage in Group Policy Preferences
What it says
Passwords are not stored in Group Policy Preferences.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMake sure passwords aren't saved in Group Policy Preferences for added security.
This control is about making sure that passwords aren't stored in what's called Group Policy Preferences, which is a Microsoft way to manage settings on lots of computers at once. Storing passwords here is risky because if someone gets hold of these settings, they could easily find and misuse these passwords, putting your entire network in danger.
Free. Save your status, tasks and notes.
Why it matters
If passwords are stored in Group Policy Preferences, attackers can recover them and use them for lateral movement and domain compromise.
How to implement
IT team should review current Group Policy Preferences: Go through all the existing preferences and ensure no passwords are stored in them.
Use Microsoft's recommendations to identify and remove any passwords if found.
System administrators should educate staff: Inform anyone who manages Group Policy about the risks of storing passwords in preferences.
Hold a brief training session to demonstrate proper configuration techniques.
IT team should set up alert systems: Configure alerts to notify administrators if any new policies attempt to store passwords.
Use existing management tools to create these notifications.
Management should update policy guidelines: Include a section in the IT policy that forbids the storage of passwords within Group Policy Preferences.
Communicate this update to all relevant stakeholders.
Create a regular audit schedule: Assign IT staff to perform routine checks on Group Policy settings every quarter.
Document findings and follow up to fix any identified issues immediately.
Keep it running
Audit GPOs for Group Policy Preferences password fields (e.g., cpassword) and remove any found; use LAPS or a secrets vault instead.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The Group Policy audit logs: Request the logs that show recent changes to Group Policy Preferences.
Look at
The entries to see if passwords were included in any updates or changes.
Good evidence
Is logs that show no passwords were stored or removed from preferences.
- Check 2 of 5What an auditor asks for
Ask for
IT policy documentation: Request the organisation's IT policy document that mentions Group Policy Preferences.
Look at
A clear statement prohibiting password storage in these preferences.
Good evidence
Is a dated policy document with specific instructions not to store passwords.
- Check 3 of 5What an auditor asks for
Ask for
Records of staff training: Request records or a schedule of any training sessions for IT staff about Group Policy management.
Look at
Attendance records and materials covered.
Good evidence
Is a dated training log with signatures from participants.
- Check 4 of 5What an auditor asks for
Ask for
Automation configuration: Request documentation or screenshots showing alerts set for Group Policy changes.
Look at
The alert settings to verify they cover password storage attempts.
Good evidence
Is an active alert system that detects any password storage attempts.
- Check 5 of 5What an auditor asks for
Ask for
The regular audit reports: Request the most recent audit reports on Group Policy Preferences.
Look at
Entries regarding password checks and any corrective actions taken.
Good evidence
Is a report that consistently finds no passwords stored in preferences.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.17.
ISM-1829 requires that passwords are not stored in Group Policy Preferences, where they can be retrieved and decrypted by domain users. This is a specific rule for the secure handling of authentication information within the management process required by Annex A 5.17. Annex A 5.17 covers allocation, management and user guidance for all authentication information, while ISM-1829 addresses one storage location.
ASD Essential Eight: 1 mapping
This control supports E8-RA-ML2.5.
ISM-1829 requires that passwords are not stored in Group Policy Preferences, where they are recoverable by any domain user and have historically been used to set shared local administrator passwords. Removing this practice supports E8-RA-ML2.5, which requires break glass, local administrator and service account credentials to be long, unique, unpredictable and managed. E8-RA-ML2.5 sets broader credential quality and management requirements, whereas ISM-1829 removes one insecure storage method.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.