4

I'm preparing to change the password requirements policy, and I want to find all the users this is going to affect. Is there a way to enumerate all AD accounts with a password with x characters? On the same note, after the policy change, how will these accounts behave? Will they be prompted to change their password to bring it within compliance?

6
  • Unless you're using Fine-Grained Password Policies then this change is going to affect all of your users. Do you mean that you want to find all users whose passwords don't meet the proposed requirement?
    – joeqwerty
    Jul 7, 2015 at 16:21
  • We're using GPO to enforce it, not sure if that counts as FGPP. I would like to find all users this is going to affect, I assumed that was the same as all the users that don't meet the proposed requirements.
    – Rex
    Jul 7, 2015 at 16:33
  • Not to sound dismissive, but of course you're enforcing it with GPO. That's the only way to manage and enforce domain based password policies. FGPP is something distinctively different. Domain password policies are managed in the Default Domain Policy and as such affect all users in the domain. FGPP allows you to create password policies scoped to specific users or groups.
    – joeqwerty
    Jul 7, 2015 at 16:40
  • You're making an incorrect distinction. The domain password policy affects ALL users in the domain (except those that are affected by an FGPP). What you're really asking is which users don't currently meet the proposed requirement.
    – joeqwerty
    Jul 7, 2015 at 16:41
  • 1
    @Rex I see where you're going with this, since user experience is king around my work. I strongly suspect you can't do it. The only information I've been able to glean about passwords from AD in the last 15 years is when each user's password will next expire. The way the password is store by default cannot be decrypted and the length is not stored or extractable from the hash. See: security.stackexchange.com/questions/29083/… Jul 7, 2015 at 17:35

2 Answers 2

4

I can answer the second part: When you change the password policy, it does not invalidate existing passwords. Passwords will only have to conform to the new policy the next time they are created, reset, or changed.

One thing you might do is look at when user's passwords are expiring next to see if you will be flooded with calls when everyone's password expires in the same week, or whether the password changes will be spread out and you can field the questions one at a time.

If you're not already doing this, it helped us a lot to send out an e-mail (or whatever) to all staff explaining everything as simply as possible and giving suggestions for picking passwords that comply with the new requirements. As a slightly related side note, AD supports spaces, which means even if you configure complexity and a large minimum length, a valid password can be a simple sentence, like this:

This is a valid, complex password in Windows Active Directory.

Also see this.

0
2

I can answer the first part.

Passwords in Active Directory are hashed by default. Hashing algorithms create results that are all the same length (128 bits/16 bytes, in this case), regardless of the length of the input. This means it is impossible to know up front which passwords will be too short*, because the password data stored in Active Directory is all the same length and not reversible. The only thing you can know is that they met whatever password policy existed at the time they were last changed.

In a sense, this also answers the second part. Even Active Directory can't know which of the passwords it's storing do or do not meet the new policy, and so it is impossible for it to automatically expire invalid passwords.


* It is technically possible to hook into the Active Directory password change process. If you use Google Apps for my Domain, for example, Google provides an optional password sync tool that will intercept the password before Active Directory hashes it and sets the corresponding Google Account to use the same password. IIRC, CloudPath XPressConnect also hooks into this feature. Therefore, if you really wanted to, you could build your own plug-in to record just relevant complexity information about the password every time it's changed. However, Active Directory does not record this information by default, and so it's likely to late for any existing planned policy change.

1
  • Awesome, so password policy is only applied when changing it. Thanks for your response!
    – Rex
    Jul 7, 2015 at 18:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .