2

I've got a question about AD accounts that have the setting PASSWD_NOTREQD enabled on them. What exactly does this setting do?

From my own research, it appears that this will cause the account to function in one of two ways either A) no password is required when the account is created and it will ignore password policies and always be able to be set to nothing or B) no password is required when the account is created but if the password is changed it must still follow password policies.

Could anyone shed some light on this for me?

Thanks!

3

User passwords and updates

Your second hypothesis is almost correct:

B) no password is required when the account is created but if the password is changed it must still follow password policies.

For this to make sense, please understand that updating a user account password can be accomplished through two seemingly similar, but very distinct operations:

  1. By setting the password
    • This is done by an administrative user
    • Typically a permission delegated to helpdesk personnel
    • Must adhere to userAccountControl settings
    • Not bound by Password History policy settings
  2. By changing the password
    • This is done by the user
    • Typically a part of first authentication attempt after password expiration
    • Must comply with Password Policy and userAccountControl settings

This means, that an Administrator can set your password to null if your account object permits it (ie. PASSWD_NOTREQD is set), regardless of the Password Policy that applies and how long it requires passwords to be.

You cannot change your password to null however, as the "Password Change" implies that you are replacing a password, not unsetting it. Upon changing the password, the new password will be validated against the effective Password Policy.

I think the easiest way to remember, is that Password Policies apply to Passwords - PASSWD_NOTREQD on the other hand, is a measure of whether you are allowed to not have a password - in which case the policy is no longer relevant.


Is it dangerous?

PASSWORD_NOTREQD might seem like a dangerous flag, but it's not in itself harmful as a lot of mechanisms prevents the usage of null-passwords (or "blank passwords"). As noted above, users cannot unset their own AD user passwords by default, and Windows (consumer and Server editions alike) will reject password authentication over the network, for users with blank passwords, by default - that means you can only log on from the console.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.