Active Directory GPO - New Password Rules

Question

In implementing a GPO for Active Directory, a colleague has mentioned that they have implemented one which disallows 'similar' new password to be chosen - i.e. 'password1' cannot be changed to 'password2'.

Seeing as AD stores all passwords as hashes, and a hash of the two options above would be markedly different and certainly not related - how can this be possible?

Answer 1

The things that can be implemented with the standard password policies are described here.

One of the possible options is to prevent reusing passwords. The administrator can set how many old passwords are saved. As far as I am aware this only prevents users from using identical passwords, it does not prevent them from using identical passwords.

Another possibility is that the password could be stored with reversible encryption. This is another standard option that can be set on a domain. Most security experts suggest that enabling this is a very bad idea.

You asked how a system could do this.

I see that it offers the option. This is more of an academic question, though - any ideas on how it works vis-a-vis the hashing described above?

When the password changes are made a reversible version of the password is transmitted to the domain controller. There are hooks where an application can intercept the password change request and get an unencrypted version of the password. Here is one OSS project that provides a hook (http://passwdhk.sourceforge.net/).

Presumably, the mentioned grabs the passwords they are being changed and then stores them using a reversible encryption. When the password is being changed the application would probably decrypt all the passwords and use something like the levenshtein distance to see if the passwords where different enough.

Answer 2

i'm guessing they're using this product

Answer 3

The only thing that is in AD by default is Age, Length, and Complexity. Complexity is defined as:

Not contain the user's account name or parts of the user's full name that exceed two consecutive characters
Be at least six characters in length
Contain characters from three of the following four categories:
English uppercase characters (A through Z)
English lowercase characters (a through z)
Base 10 digits (0 through 9)
Non-alphabetic characters (for example, !, $, #, %)
Complexity requirements are enforced when passwords are changed or created.

I would have to agree with "anon man" that you would have to have a 3rd party product to add this ability.