Specops Password Auditor

[LegacyPulsar]

Does anyone use this on their own environment? I'd love the ability to tell which users have weak/breached passwords and pre-emptively force a change before it's too late, but am somewhat concerned that the program must obviously be able to see what those passwords ARE in order to work out if they're weak and/or breached.

[timbo343]

Yeah we have it installed. It queries AD and reports on which users have weak or known passwords.

[LegacyPulsar]

Yeah we have it installed. It queries AD and reports on which users have weak or known passwords.

 

Any idea how it's analysing the content of the passwords in your local AD? I'm somewhat wary of any software that can gain access to that information. I would ​love​ to use it, but basically need to weigh up the security risks

[Chris_Cook]

I'd also be careful with software like this as well, and fully check it out before implementing it.

 

Passwords on AD (and any other system) should be encrypted and stored in a way that you can't see the original password even if you have full access to the database. The encryption will be one way only.

 

In order to do a login (or password check), you take the password you think is correct and encrypt that and then compare it to the encrypted password (password hash) that is stored in the DB. There are a few more steps to make it time-dependant and so on, but that's roughly the process. The other option is to compare the hashes in the DB to known hashes, and then you know what the password was originally.

 

So the software won't be able to identify passwords that arn't on its list, or easily generatable (like 12345678, password1, password2 etc).

 

The security of the system obviously depends on the quality of the hashing algorithms. Excel was/is very bad at this as the passwords are hashed down to a combination of 32 Capital A's and Capital B's, so its easy to go through all the combinations in a couple of minutes and get access to the excel file.

[mavhc]

There's a file to download of ntlm hashes of known leaked passwords, then you just compare the existing hashes with the database.

 

If the specops download isn't multiple GBs, then it may be comparing hashes in the cloud, which isn't super great. You can do it all for free though with some scripts

[bald_pig]

It downloads about 5gb of hashes when you run it

[mavhc]

http://www.edugeek.net/forums/how-do-you-do/203342-how-audit-active-directory-pwned-passwords.html for the scripts to check existing passwords

 

And https://blog.lithnet.io/2019/01/lppad-1.html to stop people using pwned passwords when they change them