ASD ISM 1838 Restrict UserPassword attribute in AD accounts
What it says
The UserPassword attribute for user accounts is not used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe UserPassword field should not be used to ensure account security.
In a nutshell, this control is about ensuring that the 'UserPassword' field in Active Directory (AD), which is a system many businesses use to manage user accounts, is not utilised to store actual passwords. This is important because mishandling passwords can lead to security breaches, putting sensitive data at risk and potentially harming your business's reputation and finances.
Free. Save your status, tasks and notes.
Why it matters
If the AD UserPassword attribute is populated, attackers who read directory data could obtain credentials and compromise accounts, enabling unauthorised access and data loss.
How to implement
The IT team should ensure that the 'UserPassword' attribute in Active Directory is not used for storing passwords.
They can do this by checking the configurations and confirming that alternative security measures, such as password hashes, are in use instead.
System administrators should educate staff about secure password storage practices.
This could involve running a training session that explains why passwords shouldn't be stored in plaintext fields like 'UserPassword' and what alternatives should be used.
Managers responsible for security policies should update organisational policies to explicitly forbid the use of the 'UserPassword' attribute for storing passwords.
They can add this to the section on user account management in the company security manual.
IT support personnel should regularly review the Active Directory settings and logs to ensure that no passwords are accidentally stored in the 'UserPassword' field.
They can use automated scripts to flag any changes or anomalies.
System owners should coordinate with IT security experts to implement monitoring tools that alert when attempts are made to utilise the 'UserPassword' attribute for password storage.
This might involve configuring alerts in existing IT management software.
Keep it running
Periodically scan AD for any accounts with the UserPassword attribute set, block write access to it, and train administrators to never store passwords in directory attributes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The Active Directory configuration settings document: Request the records showing that the 'UserPassword' attribute is not configured to store passwords.
Look at
Specific settings or policies that demonstrate this configuration.
Good evidence
Documentation showing 'UserPassword' is set to not receive plaintext passwords and outlining what is used instead.
- Check 2 of 5What an auditor asks for
Ask for
A report of recent user account audits: Request logs or records showing recent checks of Active Directory settings.
Look at
Whether any 'UserPassword' entries have been flagged.
Good evidence
A report with no instances of 'UserPassword' being used incorrectly and evidence of regular monitoring.
- Check 3 of 5What an auditor asks for
Ask for
A copy of the organisational policy on password storage: Request the section of the security policy document that covers password management.
Look at
Specific mention of the prohibition on using the 'UserPassword' attribute in Active Directory.
Good evidence
A clear policy statement prohibiting storing of passwords in 'UserPassword'.
- Check 4 of 5What an auditor asks for
Ask for
To see user training materials on password security: Request a sample of training content distributed to staff.
Look at
Topics covering best practices and the dangers of improper password storage.
Good evidence
Training materials outlining secure password practices and procedures for handling passwords.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of automated alerts or monitoring systems: Request verification of any systems in place that notify administrators about the use of the 'UserPassword' field.
Look at
Alert configuration details or logs of past alerts.
Good evidence
Detailed alert configurations that include monitoring of attempts to use 'UserPassword' for storing passwords.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
ISM-1838 requires a specific security configuration outcome in AD: the UserPassword attribute for user accounts is not used. This is a direct, prescriptive instance of Annex A 8.9 because Annex A 8.9 requires organisations to establish, document, implement, monitor and review security configurations across systems, and ISM-1838 is one concrete security configuration that would be managed within that configuration management regime. Annex A 8.9 is broader and process-oriented across all hardware, software, services and networks, while ISM-1838 is a single AD attribute hardening requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.