How to blacklist weak Active Directory passwords

What makes a password vulnerable to hackers?

It is human nature to use passwords that are both easy to type and easy to remember. They can be familiar keyboard patterns like 12345 or words like password. Lists of commonly used passwords (called password dictionaries) are easily accessible to hackers and attackers, giving them an edge when it comes to cyberattacks

To make matters worse, huge lists of compromised accounts and their passwords are available publicly. Since users have a tendency to reuse the same password for several sites, attackers can try to log in to multiple sites using the same credentials.

By combining the knowledge of human nature with data-driven lists of common and compromised passwords, attackers have come up with creative attack strategies like:

• Brute-force attacks: A trial-and-error method that applies a very large number of passwords and password combinations against protected resources in the hopes that one combination will be a match for the password. This is a simple but highly effective attack strategy.
• Dictionary attacks: Every word in the dictionary is tried against a password-protected resource. This is similar to brute-force attacks except that it only uses words in the dictionary.
• Password spraying: A small number of very common passwords are tried against a huge number of protected accounts. This is based on the assumption that at least a few users in the firm would have chosen weak passwords.
• Credential stuffing: Compromised accounts and passwords that are leaked from malicious sites are tried against corporate resources in the hopes that those compromised users would have reused the same credentials at work.

What is password blacklisting and how does it help prevent password attacks?

Admins can secure the organization against these attacks through password blacklisting. Password blacklisting involves banning the use of the most commonly used passwords and their variations. Blacklisting compromised and weak passwords can harden organizational security by preventing attackers from uncovering a user's domain password and getting past the initial password login into the Active Directory domain.

Password blacklisting in PowerShell

Windows PowerShell does not offer password blacklisting capabilities.

ManageEngine ADSelfService Plus, an identity security solution with multi-factor authentication, single sign-on, and self-service password management capabilities, delivers password blacklisting for Active Directory and enterprise application accounts via its Password Policy Enforcer and integration with Have I Been Pwned?. The former helps impose password policy rules that ban use of dictionary words, palindromes, and patterns, and the latter prevents the use of previously exposed passwords.

Password blacklisting configuration in ADSelfService Plus

Configuring the Password Policy Enforcer feature

With ADSelfService Plus, configure a custom password policy via the Password Policy Enforcer feature

1. Log into the ADSelfService Plus admin portal.
2. Navigate to Configuration > Self-Service > Password Policy Enforcer.
3. Enable Enforce Custom Password Policy.
4. In the Restrict Pattern tab, ban passwords using custom dictionary keyboard sequences, and palindromes.
5. Click Save.
   
   

Integrating ADSelfService Plus with Have I Been Pwned?

1. Go to Admin > Product Settings > Integration Settings > Have I been Pwned?.
2. Select Enable HaveIbeenPwned Integration.
   

Steps to blocklist weak passwords using PowerShell

Step 1: Create a weak passwords list

Store weak passwords in a text file (C:\BlocklistPasswords.txt). Add more weak passwords to this list as needed.

Step 2: Check if a user's password is in the blocklist

Compare a user’s password hash against the blocklist. This script below checks if any user is using a weak password.

Step 3: Enforce a strong password policy

Modify the default domain password policy to enforce complexity. This sets a minimum length of 12 characters, requires complex passwords, and locks the account after five failed attempts.

Step 4: Notify users with weak passwords

Send email alerts to users found with weak passwords. This will prompt users to update weak passwords.

FAQs

1. How can I check if a password is weak?

Run the script below to check for users who use weak or old passwords.

2. How do I prevent users from using weak passwords?

Use fine-grained password policies (FGPP) and enforce complexity rules using the script below.

This requires passwords to be at least 12 characters long and complex.

3. Can I check if a weak password was used recently?

Yes, check password history with the script below. This shows how many old passwords are stored in history to prevent reuse.