Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I believe this situation would be similar to many others out there, so maybe some of you can shed some light...

Supposedly, when making password changes through MS exchange every 90 days, you cannot use any simple variation of one of your old passwords, up to whatever limit the admin's set for a system.

My question: If your previous passwords are only stored as hashes, how can they check for the "just changed one letter" case. Wouldn't they have to have access to the old plain-text passwords in order to make those comparisons?

The only other thing I can think of is if upon original creation of a password, they also stored all other one character permutations of it, so that they can be banned later?

share|improve this question
This could be one for or perhaps even – Mark Henderson Mar 19 '12 at 22:20

Take the new password, try every combination where one character is different, see if the hash matches the old stored hash. Not that complicated.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.