Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Windows 2003 Active Directory: Log failed login attempts with the password used? I want to log not only the username but the password used also for debugging purpose. Is there a way to do that? One of the application is not able to connect with passwords of less than 9 characters, so I want to see what is the username and password received by the Windows 2003 system.

share|improve this question
something sounds fishy about this, if an app needs 9+ characters (strange) then just set it to 9+ characters... – tony roth Aug 8 '12 at 15:25

No. You can't do this. It would be horrible security practice to do anyway since you'd be collecting a very long list of usernames and passwords that your user likely use for other services.

What you can do is enforce a minimum password length of 9 characters in Group Policy, which seems like a sensible thing to do, given the problem at hand.

share|improve this answer
This is not what I asked. I am not talking about security practice. I have to debug some issue, and I will be using my own username/password. Also the password length policy is already there for 8 characters and above, but that particular application is not able to login with 9 characters passwords, so I want to check what is the password being send. – Priyank Bolia Aug 8 '12 at 11:20
@Priyank He answered your questions in the first part. It's not possible to log the password used for Windows login. – squillman Aug 8 '12 at 11:45
I did answer you, as @squillman points out. The passwords are salted and hashed before they're sent across the wire. – MDMarra Aug 8 '12 at 12:46

Logging the plaintext password is even technically impossible, because the server does not receive it at all — all authentication protocols currently used by Windows use the so called “NT hash” (MD4 hash of the UTF-16LE password representation) instead of the password, and even the NT hash is not passed directly to the server (even in encrypted form), but is used either as HMAC key (in NTLMv2), or as an encryption key for the Kerberos TGT. Therefore the server can only check whether the password is correct, but is unable to determine even whether several successive incorrect password attempts were using the same password.

share|improve this answer

Since it's not possible to log plaintext password failures, can you debug the issue from the other side, and look at your app to determine why it won't work with passwords <9 characters? Sounds like the application itself might have some password requirements that one would think should be configurable.

Though, for what it's worth, I think MDMarra's suggestion of forcing users to have passwords of >= 9 is a good one. With the computing power available in even a desktop (or desktop GPU), it's no longer safe to assume that 8 characters and 3 of 4 character sets is enough to keep brute force and rainbow tables attacks at bay.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.