Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know that some other companies are able to intercept their users passwords when they log on to the network. I also know that these companies create a giant database of passwords that cannot be used again; how do they do this?

share|improve this question

migrated from superuser.com Sep 26 '11 at 16:54

This question came from our site for computer enthusiasts and power users.

closed as not a real question by Massimo, Iain, John Gardeniers, Wesley, Ward Sep 27 '11 at 4:29

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

How do you know this? It seems likely that the answers provided are what is actually happening. –  datatoo Sep 26 '11 at 16:00
It's obvious; companies get hacked and passwords are dumped. One obvious example is Sony. You cant dump passwords on a running AD DC; so obviously companies are doing something different. –  null Sep 26 '11 at 16:29
Those are not the same passwords. You're thinking of a company storing passwords for a web app in plaintext in a SQL database (which is very bad security practice anyway). Totally different situation. –  sidran32 Sep 26 '11 at 16:45
website passwords and domain passwords are different, and a site can have totally inadequate security and password storage –  datatoo Sep 26 '11 at 17:05
@null: based on your comments, your question may not be specific to AD. If this is the case, you may want to edit the question to apply more generally to a wider selection of servers and logon systems. –  music2myear Sep 26 '11 at 17:23
show 1 more comment

4 Answers

It's a native feature of Active Directory, there's no need to “capture” the passwords somehow. The number of passwords “remembered” is set by a system-wide security policy by the system administrator.

Usually this functionality is implemented in such a way that just a so-called “hash” of the password is stored. When you, as a user, choose a new password, the system makes sure the new password's hash doesn't occur in the set of remembered hashes that correspond to past passwords. This way it can eliminate repeated use of the same password.

Note that a hash is actually a very large number that is computed using a cryptographic function (essentially a complex mathematical formula) from the input data (i.e. from your password). The one important thing about hashes is that there is no reasonably simple and fast way to reverse the process, i.e. to guess the actual password knowing just its hash. Hence the system can be pretty secure, preventing disclosure of past passwords.

share|improve this answer
Off-topic and doesn't answer my question. I am aware of everything you mentioned. –  null Sep 26 '11 at 15:56
So what are you really asking about? –  Ondrej Tucny Sep 26 '11 at 16:01
This answer is certainly not off-topic and stands as a reasonable explanation for what is described. +1 from me. –  Alex Forbes Sep 26 '11 at 16:06
@null: Ondrej is correct and you are not. You specified Active Directory in the title of your question, and Ondrej has succinctly (if not incredibly thoroughly, but accurately nonetheless) described the process by which Active Directory stores the hashes of the passwords and then uses this to apply desired security policies. –  music2myear Sep 26 '11 at 16:24
add comment

It's a domain level account policy titled "Enforce Password History" that a domain administrator can configure. Microsoft has documentation on the settings here.

Also, to be clear, they are not storing the plaintext password. They are storing the hash of the password. Storing passwords in plaintext is a serious security issue.

share|improve this answer
Off-topic and doesn't answer my question. I am aware of everything you mentioned. –  null Sep 26 '11 at 15:56
Please clarify your original question so that we can answer it. –  cmorse Sep 26 '11 at 16:10
add comment

Active Directory provides the interfaces for applications to intercept password change calls as they are made. For this to happen, a driver must be running on the Domain Controllers (DCs) where password changes happen (usually all of them). Once the password is encrypted and stored in AD, it's impractical to reverse the hash (and the hash is what's stored and replicated between DC's).

An example is Novell Identity Manager (IDM). In order to synchronise passwords with Active Directory you have to install an application called Password Sync, which does what I described above, on all the DCs in the domain. IDM then intercepts passwords when they are set and can do whatever you like with the password - dump it to a text file, store it in an SQL database or synchronise with another directory eDirectory.

Other systems such as Microsoft Forefront IM have similar capabilities, and it probably wouldn't be difficult to write a simple application that dumps passwords to a database (but it can only do this when they are changed).

share|improve this answer
add comment

Depending on the sort of security and the login or server system used, this answer will vary greatly.

As others have noted, if your using an Active Directory system for domain logins and you have set the option to not allow previous passwords, the hash of the password is stored for a set number of password changes and any new password hashes that match (which would mean the passwords themselves match) are rejected. This allows the system to keep track of old passwords without the system actually "knowing" the passwords themselves.

If you're dealing with web site logins, the correct method of password storage is to use a hash, just like Windows and Active Directory (and every other secure and properly configured secured system ever, it's not just a Windows thing).

However, the correct method is not always used. Examples of web sites that have been hacked and user passwords available on the black market are usually examples of sites or systems storing the passwords in what we call "plain text". This means somewhere in the system there is essentially a list of passwords that you can actually read, not confusing hashes that must be compared.

There is no "capturing" going on in the password management systems beyond simply accepting the input of the users password and comparing it with what is stored. Both secure and non-secure systems do this.

The difference between a system that compares hashes (a secure system) and a system that compares the passwords in plain text (an insecure system) is that a secure system adds the step of creating the hash before it performs the comparison with whatever it has stored.

share|improve this answer
add comment