Does anyone know if it is possible within Active Directory to add a table of 'weak passwords' that will be banned? Looking to align password policies with the new NIST recommendations:
I'm not an Active Directory expert, but from what I read so far, this should not be possible with AD alone. You might want to take a look at this Microsoft article. It explains how password polices are set up and all that. There is no mention of password dictionaries or blacklisting.
I also found this (mabye outdated) answer in the Windows Server forums. The accepted answer there also says, that this is not possible. This is a post from 2011 though.
There are third party tools which claim to accomplish this. I have no idea if these will actually work and I don't want to advertise them, so I won't link them here.
Active Directory password filters are still supported. They are native dlls that plug into lsass on domain controllers and enforce additional password policy checks above and beyond built-in Active Directory password policies.
Downside is that you have to write the dll yourself and implement whatever logic you want yourself, or buy one from somebody who can write one for you.
But what you are describing is technically feasible using the password filter mechanism... you just have to write the plug-in yourself.
Thanks for the responses. Not sure if anyone else if having this issues, but if you run a Hybrid environment you can implement a 'banned list' of passwords: