AD Attributes

Active Directory Attributes » Active Directory password attribute: ms-DS-User-Encrypted-Text-Password-Allowed

Active Directory password attribute: ms-DS-User-Encrypted-Text-Password-Allowed

This attribute indicates whether the Active Directory password for a user account will be stored in the reversible encryption format. Certain applications may use protocols that require a domain user’s password for working. When this attribute is set to true for a user, it means the password of that user can be decrypted. Hence, this setting should never be enabled for a user account unless the application requirement overrides the need to protect the password and user account.

CN ms-DS-User-Encrypted-Text-Password-Allowed
Ldap-Display-Name ms-DS-UserEncryptedTextPasswordAllowed
Attribute-Id 1.2.840.113556.1.4.1856
System-Id-Guid 5a87c7f2-93c5-454c-a8c5-8cb09613292e

For more details about this attribute, refer to this Microsoft document.

Did you know that the default Active Directory password policy hasn’t changed much since it was introduced in the early 2000s? Security was much different seventeen years ago, and it's time to consider improving your Active Directory password policy controls to improve your organization’s security posture.

ADSelfService Plus, an integrated Active Directory self-service password management and single sign-on solution, helps implement strong password complexity rules and multi-factor authentication (MFA) for endpoints, thus ensuring improved security against common credential-based attacks. Some of the highlights of ADSelfService Plus include:

  1. Custom password policy enforcer: Prevent users from setting weak and breached passwords for their accounts through an advanced password policy that bans dictionary words, keyboard sequence and supports Have I Been Pwned? Integration.
  2. OU and group-based password policies: Create multiple password policies based on users’ privileges and assign them based on OUs and groups.
  3. Endpoint MFA: Add an extra layer of security to user accounts by enabling YubiKey, biometric, Google Authenticator, and other strong authentication methods for local and remote desktop logons to Windows, Linux, and Mac endpoints.
  4. Self-service password management: Allow users to reset passwords and unlock accounts on their own; reduces help desk tickets and improves employee productivity.

Simplify password management with ADSelfService Plus.

  • Please enter a business email id
    By clicking 'Get Your Free Trial', you agree to processing of personal data according to the Privacy Policy.


Your download is in progress and it will be completed in just a few seconds!
If you face any issues, download manually here

Self-service password management and single sign-on solution

ManageEngine ADSelfService Plus is an integrated self-service password management and single sign-on solution for Active Directory and cloud apps. Ensure endpoint security with stringent authentication controls including biometrics and advanced password policy controls.