I followed this Microsoft article to enforce strong domain user passwords. Before I took this action, some domain users used simple passwords (like 123456). After I enforced strong password policy through GPO, I have confirmed that it takes effect, because changing a password using the iisadmpwd method fails with error message "Either the password is too short or password uniqueness restrictions have not been met" on the webpage.

However, those users' simple passwords are still valid, that is, server software that does Windows AD integration or LDAP integration to verify user identity still accepts old simple passwords, or, more techincally, Windows API LogonUser still accept old simple passwords. My question is: How can I thoroughly invalidate those simple passwords so that I can force those stubborn users to make a change (call AD admin for a password reset, etc.)?

I think this is a common case but it seems hard to find an answer by just Googling.


Use Stephane's approach of forcing a password change at next logon, and then after 1 week query AD for anyone without that flag set. Then disable those accounts and wait for a helpdesk call to force them to change.

Or after 1 week query AD pwdlastset as shown here: Powershell: How do I query pwdLastSet and have it make sense? and disable or proactively call those users that haven't set a password in the last 7 days and work with them to change their account passwords.

Short of that, I'm not aware of a tool that can query for "simple passwords", but maybe someone else is.

  • 1
    It's not possible at all to query existing passwords, they are never stored in their original form anywhere. – Massimo Jul 28 '13 at 14:29
  • Yeah, I knew the hash wasn't stored normally, but wasn't sure if there might be something that could say "yes, this user has a strong password per the policy" somehow. – TheCleaner Jul 28 '13 at 19:02

The common sollution is to force a password reset for all users on next logon

  • I don't think so. I think you mean "next logon to Windows desktop". But some users don't use Windows desktop, they use only Windows AD account to access some server system(mostly web based). – Jimm Chen Jul 28 '13 at 13:18
  • 2
    @JimmChen That's commonly referred to as "Password must be reset at next logoon" or "UserMustChangePassword". If your users aren't interactively using Windows, you'll need to devise some method to notify users that their password must be changed, and allow them to do so. That mechanism is outside the scope of your above question. – aNullValue Jul 28 '13 at 14:47
  • This would have a side effect of "locking" users out of anything that queries AD accounts for authentication until they logged into a workstation. I did this myself when activating it and it was a lonnnngggg week. – Nathan C Jul 28 '13 at 22:24

It depends how ethical you want to be, and what your IT Security policy says about passwords and the visibility thereof for IT staff.

One solution, and it may be frowned upon by the community would be to "audit" (ahem!) your users' passwords for strength, and then inform those that clearly don't adhere to your new standard.

For "auditing", I'd recommend John The Ripper. Like I say, it depends on how this leaves you from a policy/ethics standpoint.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.