4

Does anyone know if it is possible within Active Directory to add a table of 'weak passwords' that will be banned? Looking to align password policies with the new NIST recommendations:

https://pages.nist.gov/800-63-3/

1
  • 1
    There is no native way to do this in Active Directory - there are a number of third party solutions for this but I've not tested any. – DKNUCKLES Aug 16 '17 at 16:27
1

I'm not an Active Directory expert, but from what I read so far, this should not be possible with AD alone. You might want to take a look at this Microsoft article. It explains how password polices are set up and all that. There is no mention of password dictionaries or blacklisting.

I also found this (mabye outdated) answer in the Windows Server forums. The accepted answer there also says, that this is not possible. This is a post from 2011 though.

There are third party tools which claim to accomplish this. I have no idea if these will actually work and I don't want to advertise them, so I won't link them here.

1

It is possible using AD in combination with Microsoft Forefront Identity Manager. Here is an article explaining how to do it. It basically sets up a Management Agent which flags weak/pwned passwords.

1

Active Directory password filters are still supported. They are native dlls that plug into lsass on domain controllers and enforce additional password policy checks above and beyond built-in Active Directory password policies.

Downside is that you have to write the dll yourself and implement whatever logic you want yourself, or buy one from somebody who can write one for you.

But what you are describing is technically feasible using the password filter mechanism... you just have to write the plug-in yourself.

1

Thanks for the responses. Not sure if anyone else if having this issues, but if you run a Hybrid environment you can implement a 'banned list' of passwords:

https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Azure-AD-Password-Protection-is-now-generally-available/ba-p/377487

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.