Fly Server must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-283926 | SRG-APP-000065 | FLYS-00-000020 | SV-283926r1206132_rule | 2026-06-15 | 1 |
Description
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.
Satisfies: SRG-APP-000065, SRG-APP-000345, SRG-APP-000295, SRG-APP-000317
ℹ️ Check
Check the logon configuration in Fly Server Manager:
- Access the VM or server where the Fly Server manager is installed.
- Find the installation location of Fly Server manager.
- Open the "TimerService.exe.config" file in ...\APElements\FLY\Manager\Control\bin.
- Check the key "FailedLogOnLimitationCount".
If the value is not "3", this is a finding.
✔️ Fix
Configure the logon configuration in Fly Server Manager:
- Access the VM or server where the Fly Server manager is installed.
- Find the installation location of Fly Server manager.
- Open the "TimerService.exe.config" file in ...\APElements\FLY\Manager\Control\bin.
- Find following node and set the value to "3":
<add key="FailedLogOnLimitationCount" value="3" />