Active Directory; list of users previous passwords? [closed]

Question

I know that some other companies are able to intercept their users passwords when they log on to the network. I also know that these companies create a giant database of passwords that cannot be used again; how do they do this?

Answer 1

It's a native feature of Active Directory, there's no need to “capture” the passwords somehow. The number of passwords “remembered” is set by a system-wide security policy by the system administrator.

Usually this functionality is implemented in such a way that just a so-called “hash” of the password is stored. When you, as a user, choose a new password, the system makes sure the new password's hash doesn't occur in the set of remembered hashes that correspond to past passwords. This way it can eliminate repeated use of the same password.

Note that a hash is actually a very large number that is computed using a cryptographic function (essentially a complex mathematical formula) from the input data (i.e. from your password). The one important thing about hashes is that there is no reasonably simple and fast way to reverse the process, i.e. to guess the actual password knowing just its hash. Hence the system can be pretty secure, preventing disclosure of past passwords.

Answer 2

It's a domain level account policy titled "Enforce Password History" that a domain administrator can configure. Microsoft has documentation on the settings here.

Also, to be clear, they are not storing the plaintext password. They are storing the hash of the password. Storing passwords in plaintext is a serious security issue.

Answer 3

Active Directory provides the interfaces for applications to intercept password change calls as they are made. For this to happen, a driver must be running on the Domain Controllers (DCs) where password changes happen (usually all of them). Once the password is encrypted and stored in AD, it's impractical to reverse the hash (and the hash is what's stored and replicated between DC's).

An example is Novell Identity Manager (IDM). In order to synchronise passwords with Active Directory you have to install an application called Password Sync, which does what I described above, on all the DCs in the domain. IDM then intercepts passwords when they are set and can do whatever you like with the password - dump it to a text file, store it in an SQL database or synchronise with another directory eDirectory.

Other systems such as Microsoft Forefront IM have similar capabilities, and it probably wouldn't be difficult to write a simple application that dumps passwords to a database (but it can only do this when they are changed).

Answer 4

Depending on the sort of security and the login or server system used, this answer will vary greatly.

As others have noted, if your using an Active Directory system for domain logins and you have set the option to not allow previous passwords, the hash of the password is stored for a set number of password changes and any new password hashes that match (which would mean the passwords themselves match) are rejected. This allows the system to keep track of old passwords without the system actually "knowing" the passwords themselves.

If you're dealing with web site logins, the correct method of password storage is to use a hash, just like Windows and Active Directory (and every other secure and properly configured secured system ever, it's not just a Windows thing).

However, the correct method is not always used. Examples of web sites that have been hacked and user passwords available on the black market are usually examples of sites or systems storing the passwords in what we call "plain text". This means somewhere in the system there is essentially a list of passwords that you can actually read, not confusing hashes that must be compared.

There is no "capturing" going on in the password management systems beyond simply accepting the input of the users password and comparing it with what is stored. Both secure and non-secure systems do this.

The difference between a system that compares hashes (a secure system) and a system that compares the passwords in plain text (an insecure system) is that a secure system adds the step of creating the hash before it performs the comparison with whatever it has stored.