I want to assure the compliance of password policy in my office.
Environment Intro My environment is all windows based (server 2003/2008) user base is not more than 400 employees. Nearly 90% of all users have windows XP O/S installed on their machines. The other 10% is divided between Vista and Windows 7. The maximum strength for password is limited to 10 characters.
Problem statement I want to know the easiest, fastest, and the most reliable way of testing the windows users' passwords. I have downloaded and gone through the use of many password auditing tools (l0phtcrack, ophtcrack, samsinde).
Objectives I want an approach which enables me to enumerate the user accounts by logging into domain controller and not having to go to each individual machine and then run the software. This activity just creates un-necessary administrative workload. Additionally, I need a software that doesn’t require booting into alternate OS (as in case of ophtcrack). Doing so would affect the performance of the users and also becomes annoying.
I want to make use of rainbow tables. The specs handed to me are not enough for me to carry exhaustive brute force attack in the time that is given to me by the senior management to complete the task.
However, I have no issue regarding storage-I can dedicate as much as 1 TB for storing rainbow tables. I would appreciate if you guys can provide me with the suitable link and guide me about the things I should consider before downloading such large size files for my use.