How to audit Active directory for pwned passwords.

[ADMaster]

Requirements:

An offline copy of ntlm hashes ordered by hash from have I been pwned.

https://haveibeenpwned.com/Passwords

DSInternals

PwnedPasswordsNTLM

Source:

Pwned Passwords and NTLM Hashes! – JacksonVD

I scripted the use of this tool and filtered out OUs I did not want to audit. Then produced a CSV of users to quickly use to email them and force a password change.

 

Step 1: Prepare. Create a working directory, copy the offline hashes and pwnedpasswordsntlm tool here.

Install DSInternals if you have not already done so.

 

Step 2. Get a copy of the ntds database from a DC.

Run this command in an elevated cmd, I put it in a batch for easy reuse.

Ntdsbackup.bat

 

[color=#000000][font=Consolas][color=#0000ff]mkdir[/color] c:\audit
[color=#0000ff]ntdsutil[/color] [color=#a31515]"activate instance ntds"[/color] [color=#a31515]"ifm"[/color] [color=#a31515]"create full C:\audit"[/color] [color=#a31515]"quit"[/color] [color=#a31515]"quit"[/color][/font][/color]

 

Step 3 copy the audit folder to the working directory on your workstation.

 

 

Step 4 Run this script to get the hashes from ntds.dit, this may need to be done in an elevated session.

Get-hashes.ps1

[color=#000000][font=Consolas][color=#008000]#must have module DSInternals[/color]
[color=#008000]#use Install-Module DSInternals first[/color]
[color=#008000]#working directory[/color]
[color=#001080]$workdir[/color] = $PSScriptRoot
[color=#008000]#system reg hive[/color]
[color=#001080]$system[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\audit\registry\SYSTEM"[/color]
[color=#008000]#ntds file[/color]
[color=#001080]$ntds[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\audit\Active Directory\ntds.dit"[/color]
[color=#008000]#output hash file[/color]
[color=#001080]$hashes[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\ntlm.txt"[/color]
[color=#008000]#load module [/color]
[color=#795e26]import-module[/color] DSInternals
[color=#001080]$key[/color] = [color=#795e26]Get-BootKey[/color] -SystemHivePath [color=#001080]$system[/color]
[color=#795e26]Get-ADDBAccount[/color] -All -DBPath [color=#001080]$ntds[/color] -BootKey [color=#001080]$key[/color] | [color=#795e26]Format-Custom[/color] -View HashcatNT | [color=#795e26]Out-File[/color] [color=#001080]$hashes[/color] -Encoding ASCII[/font][/color]

 

Step 5 Run this code to get a csv report of pwnedusers. The working directory will have a file called pwnedusers.csv

You may want to edit the working directory, currently it is the same folder the script runs from.

The SkipOUs variable is a comma separated list of OUs you do not want to check, you will need to edit this for your environment.

Check-pwned.ps1

[color=#000000][font=Consolas][color=#008000]#Static file vars[/color]
[color=#008000]#working directory[/color]
[color=#001080]$workdir[/color] = $PSScriptRoot
[color=#008000]#ntlm hashes from AD[/color]
[color=#001080]$ntlmadfile[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\ntlm.txt"[/color]
[color=#008000]#csv by ou report[/color]
[color=#001080]$nltmbyou[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\ntlmou.csv"[/color]
[color=#008000]#pwned password format[/color]
[color=#001080]$pwnedpwfile[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\pwnedpw.txt"[/color]
[color=#008000]#pwned passwords by ntlm from haveibeenpwned site[/color]
[color=#001080]$pwnedpwbyntlm[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\pwned-passwords-ntlm-ordered-by-hash-v4.txt"[/color]
[color=#008000]#at risk passwords found by pwned passwords tool[/color]
[color=#001080]$pwnedpws[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\pwnedusers.txt"[/color]
[color=#008000]#pwned users report[/color]
[color=#001080]$pwnedusersfile[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\pwnedusers.csv"[/color]
[color=#008000]#csv headers[/color]
[color=#001080]$header[/color] = [color=#0000ff]@[/color]([color=#a31515]"sam"[/color],[color=#a31515]"hash"[/color],[color=#a31515]"last"[/color],[color=#a31515]"first"[/color], [color=#a31515]"mail"[/color],[color=#a31515]"ou"[/color], [color=#a31515]"userhashft"[/color])
[color=#008000]#OUs to skip[/color]
[color=#001080]$skipOUs[/color] = [color=#0000ff]@[/color]([color=#a31515]"OU=Students"[/color],[color=#a31515]"OU=outgoing"[/color])
[color=#001080]$csv[/color] = [color=#795e26]Import-Csv[/color] [color=#001080]$ntlmadfile[/color] -Header [color=#001080]$header[/color] -Delimiter [color=#a31515]':'[/color]
[color=#001080]$outcsv[/color] = [color=#af00db]foreach[/color] ([color=#001080]$rec[/color] [color=#af00db]in[/color] [color=#001080]$csv[/color]){
[color=#af00db]if[/color]([color=#001080]$rec.sam[/color] -like [color=#a31515]"*$"[/color]) {[color=#af00db]continue[/color]}
[color=#af00db]if[/color]([color=#001080]$rec.sam[/color] -eq [color=#a31515]"Guest"[/color]) {[color=#af00db]continue[/color]}
[color=#001080]$user[/color] = [color=#795e26]get-aduser[/color] [color=#001080]$rec.sam[/color] -Properties mail
[color=#af00db]if[/color]([color=#001080]$user.Enabled[/color] -eq [color=#0000ff]$false[/color] )  {[color=#af00db]continue[/color]}
[color=#001080]$DN[/color] = [color=#001080]$User.distinguishedName[/color]
[color=#af00db]if[/color] ([color=#001080]$DN[/color] -match ([color=#001080]$skipous[/color] -join [color=#a31515]'|'[/color])) {[color=#af00db]continue[/color]}
[color=#001080]$OU[/color] = ([color=#001080]$DN[/color] -Split [color=#a31515]',cn=|,ou=|,dc='[/color])[[color=#09885a]1[/color]]
[color=#001080]$rec.ou[/color] = [color=#001080]$ou[/color]
[color=#001080]$rec.first[/color] = [color=#001080]$user.givenname[/color]
[color=#001080]$rec.last[/color] = [color=#001080]$user.surname[/color]
[color=#001080]$rec.mail[/color] = [color=#001080]$user.mail[/color]
[color=#001080]$sam[/color] = [color=#001080]$rec.sam[/color]
[color=#001080]$hash[/color] = [color=#001080]$rec.hash[/color]
[color=#001080]$rec.userhashft[/color] = [color=#001080]$sam[/color] + [color=#a31515]":"[/color]+ [color=#001080]$hash[/color]
[color=#001080]$rec[/color]   }
[color=#001080]$outcsv[/color] | [color=#795e26]Export-Csv[/color] [color=#001080]$nltmbyou[/color] -NoTypeInformation -Encoding ASCII
[color=#001080]$outcsv[/color] |[color=#795e26]Select-Object[/color] userhashft| [color=#795e26]Export-Csv[/color] [color=#001080]$pwnedpwfile[/color] -NoTypeInformation -Encoding ASCII
([color=#795e26]Get-Content[/color]  [color=#001080]$pwnedpwfile[/color]) -replace [color=#a31515]'"'[/color],[color=#a31515]''[/color] | [color=#795e26]Select-Object[/color] -Skip [color=#09885a]1[/color] | [color=#795e26]Out-File[/color]  [color=#001080]$pwnedpwfile[/color] -Encoding ascii
cmd /c  [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\PwnedPasswordsNTLM.exe  [/color][color=#001080]$pwnedpwbyntlm[/color][color=#001080]$pwnedpwfile[/color][color=#001080]$pwnedpws[/color][color=#a31515]"[/color]
[color=#001080]$pwnedusers[/color] = [color=#795e26]import-csv[/color] [color=#001080]$pwnedpws[/color] -Delimiter [color=#a31515]" "[/color] -Header [color=#001080]$header[/color]
[color=#001080]$byou[/color] = [color=#795e26]Import-Csv[/color] [color=#001080]$nltmbyou[/color]
[color=#af00db]foreach[/color] ([color=#001080]$pwneduser[/color] [color=#af00db]in[/color] [color=#001080]$pwnedusers[/color]){
[color=#001080]$pwneduser.OU[/color] = [color=#0000ff]$null[/color]
[color=#af00db]foreach[/color] ([color=#001080]$byourec[/color] [color=#af00db]in[/color] [color=#001080]$byou[/color]){
[color=#af00db]if[/color]([color=#001080]$pwneduser.sam[/color] -eq [color=#001080]$byourec.sam[/color] ){
[color=#af00db]foreach[/color]([color=#001080]$prop[/color] [color=#af00db]in[/color] [color=#001080]$header[/color]){
[color=#001080]$pwneduser[/color].[color=#001080]$prop[/color] = [color=#001080]$byourec[/color].[color=#001080]$prop[/color]}}}}
[color=#001080]$pwnedusers[/color] | [color=#795e26]Export-Csv[/color] [color=#001080]$pwnedusersfile[/color] -NoTypeInformation -Encoding ASCII[/font][/color]

checkpwnedpws.zip

[mdrabble]

Many thanks for sharing this, will be definitely taking a look at this in the morning as I got an email from haveibeenpawned the other day.

[JOrdan01070]

I have not used this yet but this looks interesting https://www.knowbe4.com/breached-password-test

 

KnowBe4’s free NEW Breached Password Test (BPT) checks to see if your users are currently using passwords that are in publicly available breaches associated with your domain. BPT checks against your Active Directory and reports compromised passwords in use right now so that you can take action immediately!

[dcwhitworth]

Thanks very much for this, I will be giving this a look. I love step 4 - "Run this script to get the hashes from ntds.dit, this may need to be done in an elevated session.". I'd be concerned if you *didn't*need elevated privileges to do this !

[NnamAries]

This is a cool stuff. I will definitely take a look at it.

[TechMonkey]

Many thanks for this. Just run and found 19 staff have pwned passwords. Does anyone know enough about the source file and the script to adjust it so it will report the second column? It would be interesting to be able to tell the member of staff that their password has been discovered X number of times. May just reinforce it.

[ADMaster]

@JOrdan01070 Knowbe4 test is junk. I just ran it on my domain and it only found 1 breached password. I have a ton of student accounts with things like password1 that it did not report.

@dcwhitworth you're right. I knew the ntdsutil backup would need elevation. I was not sure about actually extracting the hashes once you had the backup off the DC.

@TechMonkey I think the format of the pwned password txt is hash:time seen in breaches

I wonder how difficult it would be to convert the tool to pure powwershell and have access to that info within the script.

 

On a side note anyone good with c++? The author of this tool has a password filter dll to prevent pwned passwords from being used. I'd like it to apply only to staff / or controlled via fine grained password policy.

[ThomL]

Looking at the DLL and its repository I've read and seen mentioned that you have to ensure that the "Passwords must meet complexity requirements" policy setting must be enabled - without it enabled does the DLL just get ignored? If so you could just enable this for staff users letting Student use any stupid password they wish?

[synaesthesia]

Cheers for this; it certainly does show up the knowbe4 program as a bit rubbish. Have instantly reset nearly a dozen passwords today as a result!

[ADMaster]

Looking at the DLL and its repository I've read and seen mentioned that you have to ensure that the "Passwords must meet complexity requirements" policy setting must be enabled - without it enabled does the DLL just get ignored? If so you could just enable this for staff users letting Student use any stupid password they wish?

Perhaps, but that setting is domain wide. I don't think it looks at fine grained password policies.

[timbo343]

What about this one from Knowbe4? https://support.knowbe4.com/hc/en-us/articles/360013570174-Password-Exposure-Test-PET- which i thik is different to the breached password test.

[Arthur]

The following password filter might be of interest. Credit to @localzuk for posting this on the Edugeek Discord server. 👍

 

Once setup it can check passwords against the Have I Been Pwned compromised password hashes list (direct link) without accessing the Internet! 🤯

 

https://github.com/lithnet/ad-password-protection

 

Lithnet Password Protection for Active Directory (LPP) enhances the options available to an organization wanting to ensure that all their Active Directory accounts have strong passwords.

 

LPP is a module that you install on your Active Directory servers that uses a password filter to inspect passwords as users attempt to change them. Using group policy, you customize the types of checks you want to perform on those passwords and they are either rejected, or approved, and committed to the directory.

 

LPP gives you the ability to take control of what a good password means to you. Whether you want to adopt the 2018 NIST password recommendations in part, or in full, it provides a rich set of group policy-based controls that allow you to enable any combination of the following checks on attempted password changes.

 

• Block compromised passwords from being used. We've made it super easy to import the HIBP data set, but you can also import any plain-text passwords or NTLM hashes that you can get your hands on.
  
• Block passwords based on certain words. Adding a banned word prevents it from being used as the base of a password. For example, adding the word 'password' to the banned word store, prevents not only the use of that word itself, but common variants such as 'P@ssw0rd', 'pa55word!' and 'password123456!'. LPP is aware of common character substitutions and weak obfuscations and prevents their use through a normalization process.
  
• Define complexity policies based on length. For example, you can require number, symbol, upper and lower for passwords less than 13 characters, but have no special requirements for passwords 13 characters or longer. Reward length, with less complexity.
  
• Regular expression-based policies. If regular expressions are your thing, you can define a regular expression that the password must match (or not match).
  
• Points-based complexity. Assign points for the use of certain characters and categories and set a minimum point threshold a password must meet.
  

It also includes the ability to audit your users' existing passwords against the compromised password list. You'll be able to find the weak and known compromised passwords, and force those users to change their password.

 

Additional features

• Full PowerShell support which is used to;
  
  • Manage the compromised password and banned word stores. Add your own banned words and compromised passwords, as well as use popular databases such as the haveibeenpwned.com downloadable password list
    
  • Test passwords and existing hashes against the compromised store
    
  • Check to see if your user's current passwords in AD are found in the compromised password store
    

  [*]Passwords never leave the domain controller

  [*]Designed for large environments where high performance is required

  [*]Creates detailed event logs

  [*]Uses a DFS-R friendly data store

  [*]No internet access required

  [*]No additional servers required for deployment

  [*]Group policy support

[MS2011]

Requirements:

An offline copy of ntlm hashes ordered by hash from have I been pwned.

https://haveibeenpwned.com/Passwords

DSInternals

PwnedPasswordsNTLM

Source:

Pwned Passwords and NTLM Hashes! – JacksonVD

I scripted the use of this tool and filtered out OUs I did not want to audit. Then produced a CSV of users to quickly use to email them and force a password change.

 

Step 1: Prepare. Create a working directory, copy the offline hashes and pwnedpasswordsntlm tool here.

Install DSInternals if you have not already done so.

 

Step 2. Get a copy of the ntds database from a DC.

Run this command in an elevated cmd, I put it in a batch for easy reuse.

Ntdsbackup.bat

 

[color=#000000][font=Consolas][color=#0000ff]mkdir[/color] c:\audit
[color=#0000ff]ntdsutil[/color] [color=#a31515]"activate instance ntds"[/color] [color=#a31515]"ifm"[/color] [color=#a31515]"create full C:\audit"[/color] [color=#a31515]"quit"[/color] [color=#a31515]"quit"[/color][/font][/color]

 

Step 3 copy the audit folder to the working directory on your workstation.

 

 

Step 4 Run this script to get the hashes from ntds.dit, this may need to be done in an elevated session.

Get-hashes.ps1

[color=#000000][font=Consolas][color=#008000]#must have module DSInternals[/color]
[color=#008000]#use Install-Module DSInternals first[/color]
[color=#008000]#working directory[/color]
[color=#001080]$workdir[/color] = $PSScriptRoot
[color=#008000]#system reg hive[/color]
[color=#001080]$system[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\audit\registry\SYSTEM"[/color]
[color=#008000]#ntds file[/color]
[color=#001080]$ntds[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\audit\Active Directory\ntds.dit"[/color]
[color=#008000]#output hash file[/color]
[color=#001080]$hashes[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\ntlm.txt"[/color]
[color=#008000]#load module [/color]
[color=#795e26]import-module[/color] DSInternals
[color=#001080]$key[/color] = [color=#795e26]Get-BootKey[/color] -SystemHivePath [color=#001080]$system[/color]
[color=#795e26]Get-ADDBAccount[/color] -All -DBPath [color=#001080]$ntds[/color] -BootKey [color=#001080]$key[/color] | [color=#795e26]Format-Custom[/color] -View HashcatNT | [color=#795e26]Out-File[/color] [color=#001080]$hashes[/color] -Encoding ASCII[/font][/color]

 

Step 5 Run this code to get a csv report of pwnedusers. The working directory will have a file called pwnedusers.csv

You may want to edit the working directory, currently it is the same folder the script runs from.

The SkipOUs variable is a comma separated list of OUs you do not want to check, you will need to edit this for your environment.

Check-pwned.ps1

[color=#000000][font=Consolas][color=#008000]#Static file vars[/color]
[color=#008000]#working directory[/color]
[color=#001080]$workdir[/color] = $PSScriptRoot
[color=#008000]#ntlm hashes from AD[/color]
[color=#001080]$ntlmadfile[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\ntlm.txt"[/color]
[color=#008000]#csv by ou report[/color]
[color=#001080]$nltmbyou[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\ntlmou.csv"[/color]
[color=#008000]#pwned password format[/color]
[color=#001080]$pwnedpwfile[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\pwnedpw.txt"[/color]
[color=#008000]#pwned passwords by ntlm from haveibeenpwned site[/color]
[color=#001080]$pwnedpwbyntlm[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\pwned-passwords-ntlm-ordered-by-hash-v4.txt"[/color]
[color=#008000]#at risk passwords found by pwned passwords tool[/color]
[color=#001080]$pwnedpws[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\pwnedusers.txt"[/color]
[color=#008000]#pwned users report[/color]
[color=#001080]$pwnedusersfile[/color] = [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\pwnedusers.csv"[/color]
[color=#008000]#csv headers[/color]
[color=#001080]$header[/color] = [color=#0000ff]@[/color]([color=#a31515]"sam"[/color],[color=#a31515]"hash"[/color],[color=#a31515]"last"[/color],[color=#a31515]"first"[/color], [color=#a31515]"mail"[/color],[color=#a31515]"ou"[/color], [color=#a31515]"userhashft"[/color])
[color=#008000]#OUs to skip[/color]
[color=#001080]$skipOUs[/color] = [color=#0000ff]@[/color]([color=#a31515]"OU=Students"[/color],[color=#a31515]"OU=outgoing"[/color])
[color=#001080]$csv[/color] = [color=#795e26]Import-Csv[/color] [color=#001080]$ntlmadfile[/color] -Header [color=#001080]$header[/color] -Delimiter [color=#a31515]':'[/color]
[color=#001080]$outcsv[/color] = [color=#af00db]foreach[/color] ([color=#001080]$rec[/color] [color=#af00db]in[/color] [color=#001080]$csv[/color]){
[color=#af00db]if[/color]([color=#001080]$rec.sam[/color] -like [color=#a31515]"*$"[/color]) {[color=#af00db]continue[/color]}
[color=#af00db]if[/color]([color=#001080]$rec.sam[/color] -eq [color=#a31515]"Guest"[/color]) {[color=#af00db]continue[/color]}
[color=#001080]$user[/color] = [color=#795e26]get-aduser[/color] [color=#001080]$rec.sam[/color] -Properties mail
[color=#af00db]if[/color]([color=#001080]$user.Enabled[/color] -eq [color=#0000ff]$false[/color] )  {[color=#af00db]continue[/color]}
[color=#001080]$DN[/color] = [color=#001080]$User.distinguishedName[/color]
[color=#af00db]if[/color] ([color=#001080]$DN[/color] -match ([color=#001080]$skipous[/color] -join [color=#a31515]'|'[/color])) {[color=#af00db]continue[/color]}
[color=#001080]$OU[/color] = ([color=#001080]$DN[/color] -Split [color=#a31515]',cn=|,ou=|,dc='[/color])[[color=#09885a]1[/color]]
[color=#001080]$rec.ou[/color] = [color=#001080]$ou[/color]
[color=#001080]$rec.first[/color] = [color=#001080]$user.givenname[/color]
[color=#001080]$rec.last[/color] = [color=#001080]$user.surname[/color]
[color=#001080]$rec.mail[/color] = [color=#001080]$user.mail[/color]
[color=#001080]$sam[/color] = [color=#001080]$rec.sam[/color]
[color=#001080]$hash[/color] = [color=#001080]$rec.hash[/color]
[color=#001080]$rec.userhashft[/color] = [color=#001080]$sam[/color] + [color=#a31515]":"[/color]+ [color=#001080]$hash[/color]
[color=#001080]$rec[/color]   }
[color=#001080]$outcsv[/color] | [color=#795e26]Export-Csv[/color] [color=#001080]$nltmbyou[/color] -NoTypeInformation -Encoding ASCII
[color=#001080]$outcsv[/color] |[color=#795e26]Select-Object[/color] userhashft| [color=#795e26]Export-Csv[/color] [color=#001080]$pwnedpwfile[/color] -NoTypeInformation -Encoding ASCII
([color=#795e26]Get-Content[/color]  [color=#001080]$pwnedpwfile[/color]) -replace [color=#a31515]'"'[/color],[color=#a31515]''[/color] | [color=#795e26]Select-Object[/color] -Skip [color=#09885a]1[/color] | [color=#795e26]Out-File[/color]  [color=#001080]$pwnedpwfile[/color] -Encoding ascii
cmd /c  [color=#a31515]"[/color][color=#001080]$workdir[/color][color=#a31515]\PwnedPasswordsNTLM.exe  [/color][color=#001080]$pwnedpwbyntlm[/color][color=#001080]$pwnedpwfile[/color][color=#001080]$pwnedpws[/color][color=#a31515]"[/color]
[color=#001080]$pwnedusers[/color] = [color=#795e26]import-csv[/color] [color=#001080]$pwnedpws[/color] -Delimiter [color=#a31515]" "[/color] -Header [color=#001080]$header[/color]
[color=#001080]$byou[/color] = [color=#795e26]Import-Csv[/color] [color=#001080]$nltmbyou[/color]
[color=#af00db]foreach[/color] ([color=#001080]$pwneduser[/color] [color=#af00db]in[/color] [color=#001080]$pwnedusers[/color]){
[color=#001080]$pwneduser.OU[/color] = [color=#0000ff]$null[/color]
[color=#af00db]foreach[/color] ([color=#001080]$byourec[/color] [color=#af00db]in[/color] [color=#001080]$byou[/color]){
[color=#af00db]if[/color]([color=#001080]$pwneduser.sam[/color] -eq [color=#001080]$byourec.sam[/color] ){
[color=#af00db]foreach[/color]([color=#001080]$prop[/color] [color=#af00db]in[/color] [color=#001080]$header[/color]){
[color=#001080]$pwneduser[/color].[color=#001080]$prop[/color] = [color=#001080]$byourec[/color].[color=#001080]$prop[/color]}}}}
[color=#001080]$pwnedusers[/color] | [color=#795e26]Export-Csv[/color] [color=#001080]$pwnedusersfile[/color] -NoTypeInformation -Encoding ASCII[/font][/color]

 

[emoji106]

[Norphy]

Well, I've now run this across my domains and a pretty significant percentage of our staff users are using pwned passwords. I'm going to pass this one up the chain. I'm not sure what they'll do with the data but at least I'll make them aware.

[synaesthesia]

One thing to bear in mind is that their particularly accounts may not have been compromised but just happen to share a password with someone that has, may not be the end of the world and can't have a unique password for everyone in the world!

[Norphy]

True enough, I don't think it's an A1 red alert security risk but it's still worth highlighting.

[fiza]

With me not being that familiar with Powershell can you tell me where I am going wrong? I get to the bit to run get-hashes.ps1 and I try to use Install-Module DSInternals but I get a message to say Install-module is not a recognised cmdlet.

 

i am trying this on a Windows 7 workstation.

[Norphy]

Which version of PowerShell have you got? Install-Module came with PowerShell 5 I think.

[ADMaster]

I wrote the script on windows 10 / powershell 5.1

This may be what you need, but if you have access to a W10 box use it.

https://www.microsoft.com/en-us/download/details.aspx?id=54616

[Garacesh]

Hate to necrobump but just want to check something isn't going screwy..

 

If the final script produces an ntlmou.csv, pwnedpw.txt, pwnedusers.csv and pwnedusers.txt that're all blank/0KB, is that good news, or has something failed?

 

The powershell window shows no error.

Completed in: 18 ms
All pwned users output to C:\audit\pwnedusers.txt