According to the 2019 Data Breach Investigation Report by Verizon, stolen credentials are the major cause of data breaches. To safeguard passwords from cyberattacks like brute-force or password spray, compliance regulations like NIST define password security rules to ensure password complexity.
A brief summary of 2019 NIST password security guidelines:
The minimum and maximum length of the passwords should be eight and sixty-four respectively.
Permit the usage of printable ASCII characters (including spaces), and Unicode characters.
Blacklist commonly used words, dictionary words, and breached passwords.
Restrict the use of repetitive or keyboard sequences.
Offer guidance, such as a password strength meter, to help users choose a strong password.
Enforce account lockouts after ten failed authentication attempts.
Enforce two-factor authentication (2FA) with advanced authentication techniques like Google or Microsoft Authenticator.
With PowerShell
It is highly complex to ensure NIST password compliance using PowerShell scripts.
With ADSelfService Plus
Configure a password policy with advanced settings via the Password Policy Enforcer
Go to ADSelfService Plus admin portal.
Navigate to Configuration > Self-Service > Password Policy Enforcer.
Enable Enforce Custom Password Policy.
Ban leaked or weak passwords, keyboard sequences, and palindromes.
Restrict consecutively repeated characters from the username or old password, as well as common character types at the beginning or end of the passwords.
Allow users to use Unicode characters in their passwords.
Display a password strength meter when users change or reset their AD passwords.
Enforce passphrases.
Click Save.
Advantages of ADSelfService Plus:
Advanced password policy controls: Ensures users use strong passwords by banning breached passwords, keyboard sequences, and more.
Improves IT security: Supports advanced multi-factor authentication techniques like biometrics and YubiKey to secure self-service password resets and account unlocks.
Password policy for hybrid AD enforcement: Admins can enforce custom password policies for users' Active Directory and cloud accounts.
Compliance: Helps comply with CJIS, PCI DSS, and HIPAA.
Using PowerShell to secure Active Directory passwords
Step 1: Enable strong password policies
Modify AD policies to require complex passwords. The script below will require passwords to be at least 12 characters long.
