Password policy and fine-grained password policies (FGPP)
You read the domain’s password and lockout policy from the attributes at the domain head, turn 100-nanosecond durations into days, decode the complexity bit, compare with rpcclient, find the fine-grained password policies (PSOs) and who they apply to, record the values and report them with advice. The values differ in every lab.
Level 201 · 45 min
A password policy is a domain’s door lock: the minimum length, the history (old passwords can’t be reused), the maximum age and the lockout threshold (after how many wrong tries an account locks). Without lockout an attacker can try a single account endlessly.
AD has one default policy and it lives at the head of the domain. Since 2008, fine-grained password policies (FGPP; the object is called a PSO) apply stricter rules to particular groups: for example 15 characters for administrators.
Some values are set at random in every lab; you must write what you see on screen.
What you will do in this lesson
- The default policy: the domain head
- Turn durations into days
- The complexity bit: pwdProperties
- A second view: rpcclient getdompwinfo
- Which policy for whom? msDS-ResultantPSO
- Every PSO and who it applies to
- Put the policy on record
- Who does the second PSO apply to?
- Password policy findings
- Short quiz
Skills you will earn
- Reading the domain’s password and lockout policy
- Turning AD’s 100 ns duration units into days
- Finding fine-grained password policies (PSOs) and who they apply to
- Writing password policy findings with advice
← Service accounts and passwords that never expire · Active Directory security: auditing and hardening · Local administrator passwords: LAPS →
Start for free