| Hostname | IP Address | Status | Assigned To | Last Scan | Actions |
|---|---|---|---|---|---|
| MONT-AP-002 | 164.231.187.39 | 2026-01-14 | |||
Finding DetailsEvaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 263DA351D2894952BBF8189FB6715621065B0A7F ~~~~~ Failed accounts: --------------------- Name: DOD_Admin SID: S-1-5-21-3515710802-3801378020-2101878990-1000 Enabled: True Last Logon: 07/06/2023 06:31:47 [840 days] Comments |
|||||
| MONT-BE-002 | 164.231.187.37 | 2026-01-14 | |||
Finding DetailsEvaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: FC31BBFC2CEB692BBFEF878BCFB3A77AD691415D ~~~~~ Failed accounts: --------------------- Name: DOD_Admin SID: S-1-5-21-2559903909-3818771750-2130456036-1000 Enabled: True Last Logon: 07/06/2023 06:02:50 [840 days] Comments |
|||||
| MONT-DB-002 | 164.231.187.38 | 2026-01-14 | |||
Finding DetailsEvaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 11F54D137F8E9EEA8782F3EBBEC2DCD07E124714 ~~~~~ Failed accounts: --------------------- Name: DOD_Admin SID: S-1-5-21-3489894170-526094123-3548415114-1000 Enabled: True Last Logon: 07/06/2023 06:13:35 [840 days] Comments |
|||||
| MONT-DC-003 | 164.231.187.34 | 2026-01-14 | |||
Finding DetailsEvaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 1C7B892F561A2193CB86D61FA0145F6304D2D90B ~~~~~ Ignored Accounts: --------------------- Name: SHB_Admin SID: S-1-5-21-1360995287-4027491577-3040029667-500 Enabled: True Last Logon: Never Failed accounts: --------------------- Name: DOD_Admin SID: S-1-5-21-1360995287-4027491577-3040029667-1000 Enabled: True Last Logon: 06/24/2025 19:14:22 [120 days] Name: HealthMailbox3295a98105294ef195ff4f5394ae0e3c SID: S-1-5-21-1360995287-4027491577-3040029667-1606 Enabled: True Last Logon: Never Name: HealthMailbox8d8eb4c107e64340876668cde6c1289e SID: S-1-5-21-1360995287-4027491577-3040029667-1607 Enabled: True Last Logon: Never Name: HealthMailboxfd82eb3f816c4428bcc7a1706f017682 SID: S-1-5-21-1360995287-4027491577-3040029667-1608 Enabled: True Last Logon: Never Name: HealthMailbox4ffeb90d1e3e42808987669877a590dc SID: S-1-5-21-1360995287-4027491577-3040029667-1150 Enabled: True Last Logon: Never Name: HealthMailboxa7603ef65a894a7abd37cc7afcd0498f SID: S-1-5-21-1360995287-4027491577-3040029667-1609 Enabled: True Last Logon: Never Name: HealthMailbox0045b0edfe864ade8de6332392102884 SID: S-1-5-21-1360995287-4027491577-3040029667-1151 Enabled: True Last Logon: Never Name: HealthMailbox2a4e029adc2c45d7a2377f21fc959267 SID: S-1-5-21-1360995287-4027491577-3040029667-1610 Enabled: True Last Logon: Never Name: HealthMailboxff1c61cd50724325bd1467262f3ab3f7 SID: S-1-5-21-1360995287-4027491577-3040029667-1611 Enabled: True Last Logon: Never Name: HealthMailbox476aa3607f714413bb95f561ccbef1c1 SID: S-1-5-21-1360995287-4027491577-3040029667-1152 Enabled: True Last Logon: Never Name: MONT-EM-NAA SID: S-1-5-21-1360995287-4027491577-3040029667-1154 Enabled: True Last Logon: Never Name: MONT-EM-SVRCP SID: S-1-5-21-1360995287-4027491577-3040029667-1155 Enabled: True Last Logon: Never Name: MONT-EM-WKSCP SID: S-1-5-21-1360995287-4027491577-3040029667-1156 Enabled: True Last Logon: Never Name: Perl, Alexandra M., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1160 Enabled: True Last Logon: 02/03/2025 10:53:32 [262 days] Name: Davis, Jason T., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1161 Enabled: True Last Logon: 01/28/2025 12:09:11 [268 days] Name: Long, Michael D., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1165 Enabled: True Last Logon: 08/18/2025 11:14:26 [66 days] Name: Arnold, Ryan W., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1172 Enabled: True Last Logon: 07/28/2025 00:23:29 [87 days] Name: Corachan, Steven, CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1173 Enabled: True Last Logon: 06/28/2025 15:04:47 [117 days] Name: user, test SID: S-1-5-21-1360995287-4027491577-3040029667-1230 Enabled: True Last Logon: 11/20/2024 15:06:00 [337 days] Name: Spain, Lance C., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1232 Enabled: True Last Logon: 04/25/2025 09:45:30 [181 days] Name: MSMEODUser SID: S-1-5-21-1360995287-4027491577-3040029667-1243 Enabled: True Last Logon: Never Name: User, Test C., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1245 Enabled: True Last Logon: 11/20/2024 15:17:52 [337 days] Name: Wright, Hayden V., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1248 Enabled: True Last Logon: 06/09/2025 18:13:25 [135 days] Name: Smith, Alexander D., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1249 Enabled: True Last Logon: 03/19/2025 13:41:00 [218 days] Name: Jones, Thomas L., Admin SID: S-1-5-21-1360995287-4027491577-3040029667-1250 Enabled: True Last Logon: Never Name: Jones, Thomas SID: S-1-5-21-1360995287-4027491577-3040029667-1251 Enabled: True Last Logon: Never Name: Sanders, James R., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1253 Enabled: True Last Logon: 06/04/2025 14:16:14 [141 days] Name: Muchuslky, Joey SID: S-1-5-21-1360995287-4027491577-3040029667-1254 Enabled: True Last Logon: 06/04/2025 14:15:29 [141 days] Name: Monks, Paul J., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1255 Enabled: True Last Logon: 08/01/2025 19:55:03 [82 days] Name: Hershock, Patricia SID: S-1-5-21-1360995287-4027491577-3040029667-1256 Enabled: True Last Logon: 06/20/2025 11:05:07 [125 days] Name: Simon, Anthony E., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1260 Enabled: True Last Logon: 08/30/2025 12:53:38 [54 days] Name: Smith, Josh A., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1645 Enabled: True Last Logon: Never Comments |
|||||
| MONT-DP-001 | 164.231.187.44 | 2026-01-14 | |||
Finding DetailsEvaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 4F0BBD6955A59F27ED6785FAFC2242904D0B130A ~~~~~ Failed accounts: --------------------- Name: DOD_Admin SID: S-1-5-21-388225469-2825430915-2362864043-1000 Enabled: True Last Logon: 07/06/2023 06:02:53 [840 days] Comments |
|||||
| MONT-MB-002 | 164.231.187.36 | 2026-01-14 | |||
Finding DetailsEvaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 091107231BDF2B3FD0B0E6F7E2EAB14E64D0DD9B ~~~~~ Failed accounts: --------------------- Name: DOD_Admin SID: S-1-5-21-3803552116-1809661109-1744339665-1000 Enabled: True Last Logon: 07/06/2023 06:02:49 [840 days] Comments |
|||||
| MONT-VSF-003 | 164.231.187.42 | 2026-01-14 | |||
Finding DetailsEvaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 94F81021CDE825A1A3D3D13E015DFD394B0EC37F ~~~~~ Ignored Accounts: --------------------- Name: X_Admin SID: S-1-5-21-4236012249-4164713760-2408648245-500 Enabled: True Last Logon: 05/12/2023 18:09:57 [894 days] No enabled accounts found that have not logged on within 35 days. Comments |
|||||
| MONT-VSF-004 | 164.231.187.43 | 2026-01-14 | |||
Finding DetailsEvaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 864633688EF6E0F6669405CBD952738333EC0C8A ~~~~~ Ignored Accounts: --------------------- Name: X_Admin SID: S-1-5-21-2502410760-3344595884-382061215-500 Enabled: True Last Logon: 07/12/2023 16:38:51 [833 days] No enabled accounts found that have not logged on within 35 days. Comments |
|||||
Check Text
Open "Windows PowerShell". Domain Controllers: Enter "Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00" This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enabled status and LastLogonDate. Member servers and standalone or nondomain-joined systems: Copy or enter the lines below to the PowerShell window and enter. (Entering twice may be required. Do not include the quotes at the beginning and end of the query.) "([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { $user = ([ADSI]$_.Path) $lastLogin = $user.Properties.LastLogin.Value $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 if ($lastLogin -eq $null) { $lastLogin = 'Never' } Write-Host $user.Name $lastLogin $enabled }" This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). For example: User1 10/31/2015 5:49:56 AM True Review the list of accounts returned by the above queries to determine the finding validity for each account reported. Exclude the following accounts: - Built-in administrator account (Renamed, SID ending in 500) - Built-in guest account (Renamed, Disabled, SID ending in 501) - Built-in default account (Renamed, Disabled, SID ending in 503) - Application accounts If any enabled accounts have not been logged on to within the past 35 days, this is a finding. Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.
Fix Text
Regularly review accounts to determine if they are still active. Remove or disable accounts that have not been used in the last 35 days.