Avoid password generator adjustments after policy change

Do you need (again) to adjust your password generator after a policy change? The best way to avoid password generator adjustments after a policy change, is to generate passwords depending on the current Domain Password Policy. Here is how it works.

Reading the password policies of a domain

First we want to read out the password policies of the domain. Via Server Manager > Tools there are two ways to find the policies:

The Group Policy Management tool shows you all policies under the domain and default domain policy, including the password policy.

The password policies can also be displayed via “Local Security Policy”, but can also be changed with the appropriate permissions.

Password Policy Properties

The Password Policy consists of the following properties, which we can configure:

• PasswordHistoryCount
• MaxPasswordAge
• MinPasswordAge
• MinPasswordLength
• ComplexityEnabled
• ReversibleEncryptionEnabled

The ComplexityEnabled and MinPasswordLength properties are relevant. The Local Security Policy tool provides the following explanations:

ComplexityEnabled: if enabled,

• the passwords can not contain samAccountName or displayName
• passwords must be at least 6 characters long
• passwords must contain certain characters (at least one character from each of three of the four categories)

MinPasswordLength: Minimum length of passwords

More information about here: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/hh994560(v=ws.10)

The PasswordHistoryCount also plays a role, as when a new password is generated, it is not possible to check whether this password has been used before (within the specified number of old passwords).

PasswordHistoryCount: Number of used passwords to be stored in AD. They must not be reused by the user).

For more information, visit: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/hh994571(v=ws.10)

Reading the Password Policy with PowerShell

The CmdLet Get-ADDefaultDomainPasswordPolicy can be used to easily read the domain’s password policy.

Other attributes such as LockoutDuration, LockoutObservationWindow and LockoutThreshold are listed here, which can be found in the Local Security Policy tool under Account Lockout Policy.

The CmdLet Set-ADDefaultDomainPasswordPolicy can be used to change the various properties using PowerShell.

First the relevant parameters are read out:

Depending on the complexity set, the generation algorithms are applied, which can be customized as desired. We show here a possible example:

As described in the article “PowerShell – Generate random password according to your own specifications” (currently only available in German), the following functions are used for this purpose:

Since we are dealing with a randomly generated password, we did not check whether the samAccountName and displayName of the user are included in the password. However, if the password is entered manually, a check is useful:

Since it is not possible to check the password history, the exceptions should be caught when setting the password for the user. In this way you can generate a new password if necessary.

Avoid password generator adjustments – the complete script

Finally, here is the complete script to avoid password generator adjustments:

Conclusion

In the article “PowerShell – Generate random password according to own specifications” (currently only available in German) we presented a way to create passwords with PowerShell. This script can also be used in our identity & access management solution FirstWare IDM-Portal, as described. If the password policy in the company changes now, this script does not necessarily have to be adapted if the domain’s password policy is observed from the outset. The passwords will then always be generated based on the current policy.

For non-IT employees who are administrating, this means no change. For example, if the HR department creates a new user in AD, the modified password generator script is automatically loaded.

---