A county finds many computer accounts with machine passwords that have not rotated for an unusually long time. What hygiene theme applies?
Select an answer to reveal the explanation.
Short Explanation
Computer accounts have their own secrets that should age out like any other password. When those secrets sit unchanged for ages, abuse windows linger. BitLocker on the disk does not retire the directory machine password problem.
Full Explanation
Computer account machine passwords are expected to rotate; unusually long-lived machine passwords can contribute to path-abuse themes and deserve review. In a county directory, stale machine account password age may enable certain abuse narratives and signals poor computer-object hygiene affecting hosts that deliver public services.
Machine account passwords do change under normal secure channel behavior—age is not meaningless. The issue is not limited to Apple schema-joined devices. BitLocker does not make computer account password age irrelevant for AD path analysis.
Exam caveat: connect stale machine passwords to specific abuse classes and monitoring gaps rather than claiming universal exploitability without context. CPTS writing should stay concept-accurate and RoE-safe—no exploit recipes.
Operational check: query computer objects for pwdLastSet outliers, investigate why rotation failed (disabled secure channel, isolation, legacy OS), remediate, and document residual risk for civic AD operations. Include stale machine-password outliers in recurring civic AD hygiene reports so operations notice secure-channel failures before assessors do. Pair age reviews with monitoring for sudden authentication anomalies on long-lived computer objects that support public workloads.