Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Yeah, I can fire up a VM or remote into something and try the password...I know...but is there a tool or script that will simulate a login just enough to confirm or deny that the password is correct?

Scenario:

A server service account's password is "forgotten"...but we think we know what it is. I'd like to pass the credentials to something and have it kick back with "correct password" or "incorrect password".

I even thought about a drive mapping script with that user account and password being passed to see if it mapped the drive successfully or not but got lost in the logic of making it work correctly...something like:

-Script asks for username via msgbox -script asks for password via msgbox -script tries to map a drive to a common share that everyone has access to -script unmaps drive if successful -script returns popup msgbox stating "Correct Password" or else "Incorrect Password"

Any help is appreciated...you'd think this would be a rare occurrence not requiring a tool to support it but...well....

share|improve this question
    
What OS? What service? –  Cristian Ciupitu Sep 23 '09 at 18:58
    
@Cristian - Windows domain accounts - just verify if the password is correct or not –  TheCleaner Sep 23 '09 at 21:04
add comment

6 Answers

up vote 10 down vote accepted
+100

JoeWare's command-line auth tool might do the trick.

Haven't used it but it appears to be pretty straightforward.

share|improve this answer
    
Genius! Perfect for what I needed! Thank you. –  TheCleaner Oct 1 '09 at 15:49
    
I've been looking for a tool like this for years! Simple, straight to the point, but it does what it says it does. give it a domain, user and password and it tells you whether they check out. –  Tom Resing Jun 10 '11 at 21:34
    
Just wanted to say thanks again after all these years...this tool still comes in handy all the time! –  TheCleaner May 30 '13 at 15:47
add comment

Powershell script:

#usage: Test-UserCredential -username UserNameToTest -password (Read-Host)

Function Test-UserCredential { 
    Param($username, $password) 
    Add-Type -AssemblyName System.DirectoryServices.AccountManagement 
    $ct = [System.DirectoryServices.AccountManagement.ContextType]::Machine, $env:computername 
    $opt = [System.DirectoryServices.AccountManagement.ContextOptions]::SimpleBind 
    $pc = New-Object System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList $ct 
    $Result = $pc.ValidateCredentials($username, $password).ToString() 
    $Result 
} 

http://powershellcommunity.org/Forums/tabid/54/aft/8034/Default.aspx

share|improve this answer
add comment

You can also use:

net use \\computername\sharename [password] /USER:]username]

If there's a share by that name on the remote computer. Or, use C$ if the account is an admin.

share|improve this answer
add comment

Why not use a network service with authentication (telnet, POP, IMAP, SMTP, what you want) ? Other side, if you are on the machine you can try su - userToTest from a non priv account. If the password is OK, you will be allowed in the userToTest homedir if the shell allow the connection

share|improve this answer
add comment

You can write an easy vbscript function which can verify this...something like:

Function GoodPassword(strAdminUsername, strAdminPassword, strNTDomain)
    Const ADS_SECURE_AUTHENTICATION = 1

    On Error Resume Next
    Set objIADS = GetObject("WinNT:").OpenDSObject("WinNT://" & _
                        strNTDomain, strAdminUserame, _
                        strAdminPassword, _
                        ADS_SECURE_AUTHENTICATION)
    if err.number = 0 then
       GoodPassword = True
    Else
       GoodPassword = False
    End If
    On Error GoTO 0
End Function

Sources:

http://www.4guysfromrolla.com/webtech/061202-1.shtml

http://hsdn.net/category_3.html

share|improve this answer
    
Please note this will lock an account out after 'n' amount failed logins, 'n' being whatever policy you have set. This should always be true of any solution which you use. –  mrTomahawk Oct 1 '09 at 15:31
add comment

You could use one of the many well known tools out there to test passwords. One I saw is L0phtcrack. Maybe there is even a way to do this offline with a dump of you authentication database. In "the other world", we use "john the ripper" for stuff like this.

share|improve this answer
    
I'm not talking about cracking passwords or testing their strength. I'm talking about a tool that can tell me if the password I enter for a particular account is that account's password. –  TheCleaner Sep 22 '09 at 18:07
    
@TheCleaner: Sure, you can create a word-list with all possible passwords for a specific account and use this list for a set of accounts. or a single one... Testing with SMB or something is a rather bad idea. It fills your logs, messes up sessions to the file server, generates load on DCs and file servers and so on. –  PEra Sep 29 '09 at 19:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.