Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Before you jump to conclusions, let me explain. We have a password reset tool that is not working. For some reason when you use it, it resets your password to some unknown value (Not what you changed it to, or what it was before). I have setup a test "user" in the appropriate OU, and I want to be able to see what the reset tool is changing the password to. That way maybe I can maybe understand what's going on. Any help would be greatly appreciated.

share|improve this question
What is the password reset tool? Why not just reset the password to a known value and have the user change their password at next login? – Bart Silverstrim Jul 21 '11 at 18:00
I'd like to know what this tool is because how is it changing the password to anything other than what it was, if it isn't using Administrator or that user's access tokens with permissions to do so?... – Bart Silverstrim Jul 21 '11 at 18:00
up vote 4 down vote accepted

AD passwords (just like Windows ones) are stored using non-reversible encryption, so the standard answer is a definite "NO".

There is a GPO settings that will tell AD (or any Windows system) to store passwords using reversible encryption, but there is no built-in tool to decrypt them (although there is some documentation floating around on how to do that). Of course, this is exactly as insecure as it looks.

share|improve this answer

If you need to see the plain text of what it's setting it to, and you can't get the reset tool to spit that info out itself, then you have two options: enabling reversible encryption, or using a password filter.

With reversible encryption, you can get at the original password, but it's not a pleasant process.

With a password filter, you can dump out all password changes to text, but that's obviously not a good thing for security when it comes to your non-test users.

If you only need to see the hash to see if it was set correctly, though, then you can dump the hash database and compare.

share|improve this answer

No. The Password attribute is "write-only". There is no mechanism exposed to provide reading of this attribute.

More information:
User-Password Attribute

share|improve this answer
That's the hash, anyway, which doesn't do a lot of good regarding this question, but you can certainly get at it through unsupported means. As I mentioned in my answer, password filters are an official, supported way to get copies of the plain passwords as they change. It's downhill from there with reversible encryption and attacks against hashes, but an unqualified "no" based on the ldap attribute is a bit.. narrow. – Shane Madden Jul 21 '11 at 18:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.