Hey everyone! We've recently updated our Active Directory password policy at my company, and I'm looking for ways to ensure that accounts comply with the new standards. Specifically, I want to target accounts with passwords that are too short without forcing a password change for everyone. We're not using password aging right now and don't have plans to implement it. What tools can you suggest that can help me audit compliance without a ton of extra features?
4 Answers
One possible approach is to download the password hashes from Active Directory and either write your own script or find an existing one to compare those hashes with online rainbow tables. This could give you a good idea of where compliance issues lie without doing a blanket password change.
Have you looked into Specops Password Auditor? It checks for expired, duplicate, and even breached passwords. They have a password policy extension that can enforce checks on new passwords to ensure compliance.
If you're after a straightforward solution, you could just pull a list of users who haven’t updated their passwords since the policy change and require them to update at their next login.
Another option is to consider Unified PAM, which can help you discover and manage accounts within your Active Directory. It allows you to enforce specific password policies and automatically tracks non-compliant passwords. It also includes auditing features to keep track of access.
You can also check out Enzoic; it's budget-friendly and has a neat password change app that explains why non-compliant passwords won't work. Plus, getting approval from the management team for implementation is usually easier.