Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In implementing a GPO for Active Directory, a colleague has mentioned that they have implemented one which disallows 'similar' new password to be chosen - i.e. 'password1' cannot be changed to 'password2'.

Seeing as AD stores all passwords as hashes, and a hash of the two options above would be markedly different and certainly not related - how can this be possible?

share|improve this question

migrated from Oct 29 '09 at 14:12

This question came from our site for computer enthusiasts and power users.

The things that can be implemented with the standard password policies are described here.

One of the possible options is to prevent reusing passwords. The administrator can set how many old passwords are saved. As far as I am aware this only prevents users from using identical passwords, it does not prevent them from using identical passwords.

Another possibility is that the password could be stored with reversible encryption. This is another standard option that can be set on a domain. Most security experts suggest that enabling this is a very bad idea.

You asked how a system could do this.

I see that it offers the option. This is more of an academic question, though - any ideas on how it works vis-a-vis the hashing described above?

When the password changes are made a reversible version of the password is transmitted to the domain controller. There are hooks where an application can intercept the password change request and get an unencrypted version of the password. Here is one OSS project that provides a hook (

Presumably, the mentioned grabs the passwords they are being changed and then stores them using a reversible encryption. When the password is being changed the application would probably decrypt all the passwords and use something like the levenshtein distance to see if the passwords where different enough.

share|improve this answer
Microsoft's own warning for reversible encryption is that it means you should effectively assume that the passwords are now not significantly safer than if they were stored in clear text. Anyone with domain admin rights can decrypt all passwords. Personally I regard that as much more of a problem far than users possibly choosing new passwords based on sequences. – Helvick Jan 24 '10 at 13:42

The only thing that is in AD by default is Age, Length, and Complexity. Complexity is defined as:

Not contain the user's account name or parts of the user's full name that exceed two consecutive characters
Be at least six characters in length
Contain characters from three of the following four categories:
English uppercase characters (A through Z)
English lowercase characters (a through z)
Base 10 digits (0 through 9)
Non-alphabetic characters (for example, !, $, #, %)
Complexity requirements are enforced when passwords are changed or created.

I would have to agree with "anon man" that you would have to have a 3rd party product to add this ability.

share|improve this answer
As comment below to anonman - This is more of an academic question, though - any ideas on how it works vis-a-vis the hashing described above? – Chris Gunner Oct 29 '09 at 16:32
According to their docs: The Sentinel is the server part which must be installed on all domain controllers. The Sentinel is the component that validates new passwords against affecting password policy rules during password changes. – Andrew Strong Oct 30 '09 at 4:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.