PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Password Policy GPO

projectblack.io | research | #active-directory | #nist | #hardening | #password-policy | #gpo
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

After cracking ~40% of passwords in AD environments, the post recommends disabling forced expiry (max age 0), raising minimum length toward 16, and passphrase training — cutting crack rates to ~5%.
Published
Collected

Related coverage

research · horizon3.ai
Metrics That Matter: An Attacker’s Perspective on Assessing Password Policy
In this post we’ll talk about different metrics NodeZero gathers from analyzing password hashes in the Active Directory database.
blog · semperis.com
AD Security 101: Lock Down Risky User Rights
User rights assigned via GPOs—debug programs, back up files, take ownership, and more—become risky when misassigned. Explains how to review and lock down dangerous user rights in Active Directory.
blog · semperis.com
AD Security 101: GPO Logon Script Security
GPO logon scripts automate logon tasks, but sprawling, poorly maintained GPO structures invite abuse. Covers how scripts work (scripts.ini) and how to secure them.
blog · semperis.com
AD Security 101: Domain Controller Security
DC security essentials: promotion changes a server's logon model and access must be tightly restricted. GPOs linked to the Domain Controllers OU affect all DCs, so mistakes are high-impact.
blog · semperis.com
NIST joins Microsoft in Changing How We Should Think About Passwords
NIST's new digital-authentication guidance echoes Microsoft: 8-character minimums, 64+-character maximums to encourage passphrases, and banned-password dictionaries—shifting the burden to systems.
research · projectblack.io
Disable TLS 1.0 and 1.1 via GPO
Disabling TLS 1.0/1.1 (and Triple DES) on Windows via GPO: set the SCHANNEL protocol Enabled DWORDs to 0. The post notes this is server-side only and doesn't restrict outbound client connections.
Back