5

I want to assure the compliance of password policy in my office.

Environment Intro My environment is all windows based (server 2003/2008) user base is not more than 400 employees. Nearly 90% of all users have windows XP O/S installed on their machines. The other 10% is divided between Vista and Windows 7. The maximum strength for password is limited to 10 characters.

Problem statement I want to know the easiest, fastest, and the most reliable way of testing the windows users' passwords. I have downloaded and gone through the use of many password auditing tools (l0phtcrack, ophtcrack, samsinde).

Objectives I want an approach which enables me to enumerate the user accounts by logging into domain controller and not having to go to each individual machine and then run the software. This activity just creates un-necessary administrative workload. Additionally, I need a software that doesn’t require booting into alternate OS (as in case of ophtcrack). Doing so would affect the performance of the users and also becomes annoying.

I want to make use of rainbow tables. The specs handed to me are not enough for me to carry exhaustive brute force attack in the time that is given to me by the senior management to complete the task.

However, I have no issue regarding storage-I can dedicate as much as 1 TB for storing rainbow tables. I would appreciate if you guys can provide me with the suitable link and guide me about the things I should consider before downloading such large size files for my use.

Improve this question
2
  • I have just updated my question guys. Hope it clear the confusion now.
    – Saladin
    Commented Apr 8, 2012 at 7:14
  • I have edited to clarify you are focusing on password strength audit, not enumeration.
    – Rory Alsop ♦
    Commented Apr 9, 2012 at 14:27

2 Answers 2

Reset to default
4

Updated in reference to your update:

For a password strength audit you just want to grab the domain SAM file and run your brute forcer of choice on it. If you prefer to use rainbow tables, you can just run the hashes through your rainbow table tool.

For most rainbow tables providers, the idea is that you provide a portion of rainbow table in return for a download of the larger store. A google search will find you a few options here.

A terabyte is probably a reasonable start, however it makes sense to download a range of rainbow tables relevant to your environment, so you may want to reserve a few terabytes - it is so cheap these days it makes sense to over-spec storage space.

Improve this answer
4
  • or is there maybe a concern that users have both local and domain accounts?
    – Mark Beadles
    Commented Apr 6, 2012 at 15:20
  • @MarkBeadles - The local accounts are likely cached domain accounts. Even if they are actual local accounts not connected to the domain, they wouldn't have access to the domain, since they are local accounts. This means the contents of the computer would be limited to the access of the local accounts. Easy enough to secure, delete all local accounts, lol
    – Ramhound
    Commented Apr 9, 2012 at 17:39
  • 1
    @Ramhound Well, there had been a paragraph that was added to the question (now vanished so I didn't see it) that stated he was only looking at domain accounts.
    – Mark Beadles
    Commented Apr 9, 2012 at 17:53
  • @Ramhound I indeed was and still is referring to the fact that i'm only interested in DOMAINs accounts only not local. You are right the paragraph about this info did got disappeared must be bad editing on my side. But thanks for clearing this up.
    – Saladin
    Commented Apr 10, 2012 at 0:19
2

The easiest, fastest, and most reliable way to test user passwords is to set strong minimum password requirements and force a domain-wide password reset. After everyone resets their passwords, you will know they all meet your minimum requirements.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .