Scanning Active Directory for weak passwords

Troubleshooter24

755 pts.

Tags:

Active Directory

Active Directory security

Network security

Network Security Management

Network Security Policies

Password policies

Password strength

Is it possible to scan our active directory and see if people have weak passwords? We have upped the password policy but what about for users that already have passwords and are not scheduled to changed them yet?

Asked: December 28, 2010 9:06 PM Last updated: September 25, 2013 3:32 PM

Answer Wiki

Last updated: September 17, 2013 4:42 PM GMT

Michael Tidmarsh62,795 pts.
History
Contributors
- Ordered by most recent
- Michael Tidmarsh62,795 pts.
- Denny Cherry68,410 pts.

Thanks. We'll let you know when a new response is added.

You can’t view the users passwords in AD as they are encrypted, typically with a one way encryption. Your best bet would probably be to simply change all the accounts to be required to change their passwords on next login.

———–

There is small tool LC5, which helps to overcome your problems. It is compatible with Windows NT/2000/XP/2003. Though you didn’t mention here which flavor you are using!

Alternatively, you can create an admin-level account (or if exists) in windows domain.
Now download PWDUMP3 (from SearchEnterpriseDesktop)
and run this, and try to connect to a domain controller and extracted the password hashes.
Again, download a small tool called CAIN from here.
and run to extracted hashes (which is made text file) by this CAIN SW. Now it extracts all passwords or reveal weak passwords. (Remember, this method is bit tricky and take care)

Another, there is a very good guide about almost the same problem, which Mr. Labnuke, already discussed and answered. Please visit here for this guide…..

RECHIL–

Discuss This Question: 4 Replies

Spadasoe Dec 29, 2010 2:18 PM GMT

Use powershell to query users password info and force resets. I use Quest PowerGui and can get password settings for all users, select users by password age, and force a reset.

5,130 pointsBadges:

report
Stevesz Dec 29, 2010 4:03 PM GMT

You can set this through group policy to a certain extent. Take a look at the options offered to you and determine if it will meet your needs.One nifty little trick would be to give the passwords a certain length of time before they expire and need to be reset. I believe the default is 42 days. If you can wait this long, leave it be, and, eventually, all the passwords will be in compliance (about 6 weeks). Once this has occurred, you can extend the period between password changes or be ready for a lot of grumbling around the 6 week period, though everyone will slowly fall out of sync with each other. The reason for this is that people will get a period of time to change the password and start getting warnings about a week prior to the time needed before the change. Some people will do this right away, other will wait until they absolutely need to change the password, and still others will do it sometime in between. Another setting is the number of passwords to remember. The default is 24, so the user must use 24 different passwords before they can reuse password the first. This will prevent users from using My_Dogs_Name1, changing it to My_Dogs_Name!, then on the next change going back to My_Dogs_Name1.

2,015 pointsBadges:

report
Darkstar911 Dec 29, 2010 11:14 PM GMT

Get MBSA from microsoft. It will give you a report of accounts with weak passwords.

790 pointsBadges:

report
Kevin Beaver Sep 25, 2013 3:32 PM GMT

Elcomsoft (www.elcomsoft.com) has some of the best tools for this type of analysis. Check them out.

26,075 pointsBadges:

report