Arthur Posted December 14, 2017 Posted December 14, 2017 How would you set it to only work with Staff Accounts? The password policies are applied to AD groups. See the quick start guide for more details. https://wizardsoft.nl/files/ActivePasswordsReadme.pdf
kearton Posted December 14, 2017 Posted December 14, 2017 How does it work if you buy it only for Staff? How would you set it to only work with Staff Accounts? Depending on the product, you only apply the policy to a certain OU or AD group.
kearton Posted December 17, 2017 Posted December 17, 2017 Wizardsoft isn't going to be cost effective for us after all. You can't just buy a license for some users (e.g Staff) as you have to buy a license for EVERY user object in AD. D'oh!
Arthur Posted December 19, 2017 Posted December 19, 2017 Wizardsoft isn't going to be cost effective for us after all. You can't just buy a license for some users (e.g Staff) as you have to buy a license for EVERY user object in AD. D'oh! Is that literally every user object or just all active user object (students, staff and admin accounts)? If the former it would cost 3 x as much as it needs to for my school.
Arthur Posted December 19, 2017 Posted December 19, 2017 (edited) I have also come across a free alternative, but it doesn't look like it's suitable for use in production (nor actively developed). OpenPasswordFilter An open source custom password filter DLL and userspace service to better protect / control Active Directory domain passwords. Edited December 19, 2017 by Arthur
kearton Posted December 19, 2017 Posted December 19, 2017 Is that literally every user object or just all active user object (students, staff and admin accounts)? If the former it would cost 3 x as much as it needs to for my school. For every ENABLED user account. So for me this means instead of just licensing 250 staff/service accounts, I also have to license all my 1700+ student/exam/controlled assessment/etc accounts which will never use it. They offered me a 40% discount to "ease the pain in that case" (their words) but still claim they "are by far the cheapest solution if targeting all users" (again, their words). They fail to realise that their competition lets you just target a subset of AD users which makes them cheaper... Surely they'd rather win SOME business rather than handing it to their competitors? #facepalm 1
rinzwind Posted October 1, 2018 Posted October 1, 2018 For every ENABLED user account. So for me this means instead of just licensing 250 staff/service accounts, I also have to license all my 1700+ student/exam/controlled assessment/etc accounts which will never use. Seems the licensing has been changed to number of targeted user for some time now. If you only need a policy for your staff, thats possible.
Cw2k Posted October 1, 2018 Posted October 1, 2018 I have also come across a free alternative, but it doesn't look like it's suitable for use in production (nor actively developed). OpenPasswordFilter Yelp are using a modified version of this https://engineeringblog.yelp.com/2018/04/ad-password-blacklisting.html One very important thing to be careful of with these password filters is they must return true or false no matter what error they encounter. If they crash and don’t handle it they will crash the domain controller.
Arthur Posted October 1, 2018 Posted October 1, 2018 (edited) Yelp are using a modified version of this https://engineeringblog.yelp.com/2018/04/ad-password-blacklisting.html One very important thing to be careful of with these password filters is they must return true or false no matter what error they encounter. If they crash and don’t handle it they will crash the domain controller. Funnily enough I posted the same thing in the PassFiltEx thread. www.edugeek.net/forums/downloads/198150-passfiltex-free-active-directory-password-filter-blacklisting-bad-passwords.html#post1694081 Edited October 1, 2018 by Arthur
gshaw Posted October 1, 2018 Posted October 1, 2018 Microsoft of course will sell you Azure AD Password Protection, which is yet-another add-on product requiring Azure AD Premium https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises The whole of Office 365 feels like trial-ware these days. You get spam filtering but effective anti-phishing costs extra. Users can self-reset passwords but only with Premium. MFA can be enabled but can't be granularly controlled without Conditional Access, which is... you guessed it... Premium. We're lucky we get the core subscription for free in Edu yet these add-ons still look expensive but imagine seeing this as a commercial customer paying full-price for the base O365 license
chaplic Posted October 3, 2018 Posted October 3, 2018 A freebie option sort-of in this ballpark is haveibeenpwnd.com You use this to check if your email address has been compromised in various hacks, but you can also sign up your entire domain. Microsoft has a bad password feature that runs in the cloud but hooks into on-prem AD, free if you have the right license. https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad
gshaw Posted October 3, 2018 Posted October 3, 2018 Indeed, got an alert for one of our users recently. Have just had my request for AAD Premium approved so should be able to have the Bad Password feature up and running soon
ADMaster Posted January 7, 2019 Posted January 7, 2019 Hello all, I’ve come across this as we have had users getting phished with the we hacked your webcam scam. I’ve come across OPF and the yelp blog, but can’t find good directions on it. Has anyone impended it. One set of directions suggested creating your own rules with hashcat, The other said to just dump all the hashes into SQL. I do have azure AD p1 so should have access to the MS implementation of this. However I think the password changes are done on my local DC and synced. I do have write back enabled, so they can change it via the web page. I’d also want to only use the banned passwords for staff and not students. Is this possible with either solution? Thanks,
gshaw Posted January 7, 2019 Posted January 7, 2019 I'm still waiting for the Azure Password Protection product to come out of beta. Was told Q1 2019 so shouldn't be too much longer.
tom_newton Posted January 8, 2019 Posted January 8, 2019 Has anyone looked at https://www.passwordrbl.com
kennysarmy Posted January 8, 2019 Posted January 8, 2019 Our current policy could certainly be improved upon: Enforce password history 3 passwords remembered Maximum password age 120 days Minimum password age 0 days Minimum password length 6 characters Password must meet complexity requirements Disabled Store passwords using reversible encryption Disabled Account Policies/Account Lockout Policy Account lockout threshold 0 invalid logon attempts I think moving to a much higher password age so that passwords don't need to be changed so frequently and then change to 11 characters which must meet complex requirements might be the way to go. But once I make the change in AD - will that prompt everyone to change their passwords immediately - or do I ask everyone to change their passwords first.....is that less disruptive?
Primus Posted January 8, 2019 Posted January 8, 2019 Our current policy could certainly be improved upon: Enforce password history 3 passwords remembered Maximum password age 120 days Minimum password age 0 days Minimum password length 6 characters Password must meet complexity requirements Disabled Store passwords using reversible encryption Disabled Account Policies/Account Lockout Policy Account lockout threshold 0 invalid logon attempts I think moving to a much higher password age so that passwords don't need to be changed so frequently and then change to 11 characters which must meet complex requirements might be the way to go. But once I make the change in AD - will that prompt everyone to change their passwords immediately - or do I ask everyone to change their passwords first.....is that less disruptive? Why force changes at all? NCSC guidance is quite clear.
DJ-1701 Posted January 8, 2019 Posted January 8, 2019 Our current policy could certainly be improved upon: Enforce password history 3 passwords remembered Maximum password age 120 days Minimum password age 0 days Minimum password length 6 characters Password must meet complexity requirements Disabled Store passwords using reversible encryption Disabled Account Policies/Account Lockout Policy Account lockout threshold 0 invalid logon attempts I think moving to a much higher password age so that passwords don't need to be changed so frequently and then change to 11 characters which must meet complex requirements might be the way to go. But once I make the change in AD - will that prompt everyone to change their passwords immediately - or do I ask everyone to change their passwords first.....is that less disruptive? Why force changes at all? NCSC guidance is quite clear. I don't know... looks a little small to me... https://www.ncsc.gov.uk/content/files/NCSC%20Password%20Security_1.png 1
Primus Posted January 8, 2019 Posted January 8, 2019 I don't know... looks a little small to me... https://www.ncsc.gov.uk/content/files/NCSC%20Password%20Security_1.png You're aware that's just an infographic right??? https://www.ncsc.gov.uk/articles/problems-forcing-regular-password-expiry
DJ-1701 Posted January 8, 2019 Posted January 8, 2019 (edited) You're aware that's just an infographic right??? https://www.ncsc.gov.uk/articles/problems-forcing-regular-password-expiry Yes, I was being silly, I didn't get all that rep for being serious all the time. Most of it I just stole when other Edugeeks were sleeping at the keyboard. If you look on the picture it does state that advice too and very clearly. Edited January 8, 2019 by DJ-1701 2
ADMaster Posted April 29, 2019 Posted April 29, 2019 Azure AD Password Protection is now generally available. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-faq https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Azure-AD-Password-Protection-is-now-generally-available/ba-p/377487 https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad Has anyone set this up, the documentation is contradictory? The FAQ states it does not discriminate against what users it is applied to, but the eliminate bad passwords article says you need a P1 or P2 license. I'd like to apply this to only staff and if only staff have P1 in theory I'm applying it only to a subset of users. Now that this is out of preview, can anyone confirm my use case idea?
localzuk Posted April 29, 2019 Author Posted April 29, 2019 It applies to the whole domain, so you can't run it on a subset of users. That's where it doesn't discriminate - but to do so, you need the right licenses to cover every user. Makes it almost useless for us though sadly, because you try getting a 6 year old to remember a non-word based password.
gshaw Posted April 29, 2019 Posted April 29, 2019 Azure AD Password Protection is now generally available. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-faq https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Azure-AD-Password-Protection-is-now-generally-available/ba-p/377487 https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad Has anyone set this up, the documentation is contradictory? The FAQ states it does not discriminate against what users it is applied to, but the eliminate bad passwords article says you need a P1 or P2 license. I'd like to apply this to only staff and if only staff have P1 in theory I'm applying it only to a subset of users. Now that this is out of preview, can anyone confirm my use case idea? @ADMaster yup I installed it the other day, works spot on if you follow through the steps running the PowerShell etc. For every staff P1 license you should have 15 free student ones so you should be able to cover all users. Have messaged MS though as some obviously bad passwords aren't being picked up. Hoping they'll share intelligence with / from haveibeenpwned on that front
ADMaster Posted April 29, 2019 Posted April 29, 2019 @gshaw thanks didn't know about the 15 to 1 license thing for students. That does mean I'll be able to cover everyone. There are solutions that work directly with the data from haveibeenpwned I've wrote about somewhere in another thread. However as @localzuk says they're next to useless because of younger students.
gshaw Posted April 29, 2019 Posted April 29, 2019 @gshaw thanks didn't know about the 15 to 1 license thing for students. That does mean I'll be able to cover everyone. There are solutions that work directly with the data from haveibeenpwned I've wrote about somewhere in another thread. However as @localzuk says they're next to useless because of younger students.Yeah I wanted to stick with something supported by MS, seems odd to me they're not using the hibp list given Troy Hunt works for MS.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now