ASD ISM 1930 Prevent storing passwords in Group Policy Preferences
What it says
Passwords are prevented from being stored in Group Policy Preferences.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure passwords are not saved in Group Policy to enhance security.
This rule is about making sure that no one saves passwords inside the system settings of your organisation's network. It's crucial because if someone malicious gains access, they could easily find these passwords and use them to break into your secure systems, putting sensitive information at risk.
Free. Save your status, tasks and notes.
Why it matters
If passwords are stored in Group Policy Preferences, attackers can decrypt them from SYSVOL and rapidly escalate privileges across the domain.
How to implement
IT Team: Ensure that Group Policy Preferences within the network settings do not contain any saved passwords.
This can be done by reviewing each Group Policy setting and making sure passwords are left blank.
IT Team: Train staff on the importance of not storing passwords in Group Policy Preferences.
Conduct a brief training session to explain why this practice is risky and how to manage passwords safely.
System Administrator: Disable the ability to store passwords within Group Policy Preferences.
This involves accessing the Group Policy Management Console and ensuring that password options are not being filled out or used.
Cyber Security Lead: Set up a regular audit to check that no new Group Policies are created with passwords stored in them.
Schedule these checks monthly to ensure compliance.
IT Security Team: Implement an alternate secure method for managing passwords, such as using a dedicated password manager.
Set up and instruct staff on how to use the password manager effectively.
Keep it running
Audit GPP for cpassword entries and remove/replace them; use LAPS/managed service accounts and restrict SYSVOL access and replication.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The current list of Group Policy settings: Request a document or report listing all active Group Policy Preferences.
Look at
Whether any entries have password fields filled in: Check each setting to ensure there are no stored passwords.
Good evidence
A comprehensive list where no group policy contains any saved password.
- Check 2 of 4What an auditor asks for
Ask for
Recent training records: Request documentation or attendance lists for training sessions covering password management.
Look at
The training content and attendee list to ensure it includes information on the risks of storing passwords.
- Check 3 of 4What an auditor asks for
Ask for
To see documentation on password management policies: Specifically request policies related to Group Policy settings.
Look at
Whether the policy clearly states that passwords must not be stored in Group Policy Preferences.
- Check 4 of 4What an auditor asks for
Ask for
Records of the regular audits conducted on Group Policy Preferences.
Look at
The frequency and findings of these audits.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.17.
ISM-1930 requires organisations to prevent passwords being stored in Group Policy Preferences (GPP), removing a known mechanism for exposing plaintext/reversible credentials in domain environments. Annex A 5.17 requires broader governance and control over the allocation, management and handling of authentication information across the organisation. Preventing GPP password storage (ISM-1930) is one specific technical enforcement that supports compliant authentication information management under Annex A 5.17, but Annex A 5.17 extends well beyond GPP to all credential types and lifecycle processes.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.