AD DS - Password Policies

Password Policies

Establish password policies based on organizational needs

Ensure users cannot select simple password or reuse passwords

When securing your user accounts use the Password Policy settings. You should configure the properties of the passwords that users might select. Use these settings to make sure users don’t select simple passwords, or passwords that have been recently used. You can only have one standard password policy in a domain.

Setting	Description	Values
Enforce password history	The number of unique, new passwords that must be associated with a user account before an old password can be reused.	Default setting: 24 passwords
Maximum password age	Number of days that a password can be used before the user must change it.	Recommended setting: 42 days
Minimum password age	Number of days that a password must be used before the user can change it.	Default setting: 1 day
Minimum password length	Minimum number of characters that a user’s password must contain.	Default setting: 7 characters High security: 15 characters
Complexity requirements	Required password characteristics. Don't disable.	Does not contain your name or user name. Has at least six characters. Contains characters from different charsets

Contains characters from 3 of these 4 for charsets:  Uppercase letters [A–Z]; Lowercase letters [a–z]; Numerals [0–9]; Special, non-alphanumeric characters, such as !@#)(*&^%

Event ID 4793 - The Password Policy Checking API was called

Event ID 4793 - The Password Policy Checking API was called

The Password Policy Checking API allows an application to check password compliance against an application-provided account database or single account and verify that passwords meet the complexity, aging, minimum length, and history reuse requirements of a password policy.

Log Sample

{
 "EventTime": "2017/11/17 04:04:12"
 "Hostname": "WIN-AE4MOB56I4P.changeme.com"
 "Keywords": -9214364837600034816
 "EventType": "AUDIT_SUCCESS"
 "SeverityValue": 2
 "Severity": "INFO"
 "EventID": 4793
 "SourceName": "Microsoft-Windows-Security-Auditing"
 "ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}"
 "Version": 0
 "Task": 13827
 "OpcodeValue": 0
 "RecordNumber": 2034819
 "ProcessID": 776
 "ThreadID": 2032
 "Channel": "Security"
 "Message": "The Password Policy Checking API was called"
 "Category": "Audit Other Account Management Events"
 "TargetUserName": "sig"
 "SubjectUserSid": "S-1-5-21-924791265-3775684568-2843720401-500"
 "SubjectUserName": "Administrator"
 "SubjectDomainName": "changeme"
 "SubjectLogonId": "0x33903e"
 "Workstation": "DC01"
 "Status": "0x0"
 "EventReceivedTime": "2017/11/17 04:04:12"
 "SourceModuleName": "in"
 "SourceModuleType": "im_msvistalog"
}

General Description

• This event generates each time the Password Policy Checking API is called.
• This event, for example, generates during Directory Services Restore Mode (DSRM) account password reset procedure to check new DSRM password.
• This event generates on the computer where Password Policy Checking API was called.

Detail Description

Subject:

• SubjectUserSID: SID of account that requested the “create Computer object” operation. 
• SubjectUserName: the name of the account that requested the “create Computer object” operation.
• SubjectDomainName: subject’s domain name. Formats vary, and include the following:

Domain NETBIOS name example: CONTOSO

Lowercase full domain name: contoso.local

Uppercase full domain name: CONTOSO.LOCAL

For some well-known security principals, such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.

• SubjectLogon ID: hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “4624: An account was successfully logged on.”

Additional Information

• Workstation: name of the computer from which the Password Policy Checking API was called.
• TargetUserName: the name of account, which password was provided/requested for validation. This parameter might not be captured in the event, and in that case appears as “-”.
• Status Code: typically has “0x0” value. Status code is “0x0”, no matter meets password domain Password Policy or not.

Password Security

Attacker could you varieties of tools and technique to find your passwords. Some tools are freely available and could be very powerful. Therefore, users should be very careful when it comes to securing your passwords. Let's look at how passwords are cracked and how we can secure ourself from attack.

How passwords are cracked

1. Interception
Passwords can be intercepted as they are transmitted over a network.

2. Manual Guessing
Personal information, such as name and date of birth can be used to guess common passwords.

3. Social Engineering
Attackers use social engineering techniques to trick people into revealing passwords.

4. Brute Force Attack

Guessing of millions and billions of passwords until the correct one is found. Bad thing is ... this can be automated

5. Stealing Passwords

Many have the habit of storing the passwords either in sticky notes or in a device. Such insecurely stored passwords can be stolen.

6. Shoulder Surfing

This is a process of looking/observing when someone is typing a password.

7. Key Logger

Malicious software could be installed in your device which will store the password you type.

How to remain secure

1. Blacklist the most common passwords
2. Don't store passwords in plaintext. If you need to write it somewhere... write with some forms of encoding. Like say your passwords is AbrakaDabra. write it something like !Abraka0%0Dabra#$#. You should however remember what sorts of special character you are using and which is used for encoding.
3. Use password generator for various applications.
4. Do not use same passwords in multiple websites.
5. Do not use default vendor credentials
6. Use account lockout or monitoring tools to prevent brute force attack.