ADPWD-001: Política de contraseñas predeterminada del dominio
- Plataforma
- Active Directory
- Categoría
- AD Password & Lockout Policies
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La directiva predeterminada del dominio (Default Domain Policy) define la configuración de referencia de contraseñas y bloqueo de cuentas para todos los usuarios del dominio. Esta política debe imponer requisitos de contraseñas robustos, ya que se aplica a toda cuenta no cubierta por una política de contraseñas específica de grano fino
Por qué importa
The Default Domain Policy is the password floor for the entire forest path that touches this domain. If the floor is low, every account that is not explicitly raised by a Fine-Grained Password Policy lives under that low floor, including service accounts, helpdesk accounts, shared admin accounts, and the long tail of users who chose the shortest password the policy would accept. Three concrete attack surfaces expand directly with a weak Default Domain Policy. First, online password spraying: with lockoutThreshold disabled (0) or set very high (greater than 50), an attacker who has scraped usernames from OWA, Teams, or LDAP can attempt one or two passwords per account per observation window across the entire user population without ever locking an account, and a single weak password (Spring2026!, Welcome1, Password123) typically yields a foothold within the first sweep. Second, offline cracking of NTDS.dit: once an attacker has Domain Controller access (DCSync, VSS shadow copy, restore from backup), they extract the NT hashes for every account and run hashcat. The crack rate is determined entirely by minPwdLength and complexity. At 8 characters with complexity disabled, 100 percent of hashes fall in hours on commodity GPU hardware; at 14 characters with complexity enabled the practical recovery rate drops by orders of magnitude. Third, AS-REP roasting and Kerberoasting: both techniques produce offline-crackable material whose viability is bounded by the password policy applied to the target account. A weak Default Domain Policy directly determines how long the resulting RC4-TGS or AS-REP hash survives a hashcat run. Microsoft Defender for Identity, Mandiant M-Trends, and the Verizon DBIR consistently list weak or absent password policy as a top-five root cause of identity-tier compromise.
Ruta de ataque
Step 1: Reconnaissance. The attacker, holding any valid domain credential (intern, contractor, harvested via phishing), runs Get-ADDefaultDomainPasswordPolicy or queries the domain object via LDAP for minPwdLength and lockoutThreshold. PowerView Get-DomainPolicy, BloodHound collection, and Impacket samrdump.py all expose the values without elevated privileges. Step 2: Username harvesting. The attacker enumerates the user population via LDAP (Get-ADUser -Filter *), Azure AD / Entra ID UserPrincipalName scraping, GAL extraction from compromised Exchange, or username generation from the company directory. A typical mid-size enterprise yields 2,000 to 20,000 candidate usernames. Step 3: Password spray. The attacker selects a low-entropy candidate (Season+Year, Company+Number, Welcome1, P@ssw0rd) and authenticates against an exposed endpoint: Kerberos pre-auth (Rubeus, kerbrute), LDAP simple bind, NTLM via SMB or HTTP, Azure AD / Entra ID sign-in, OWA, Autodiscover, or RDP. With lockoutThreshold = 0 the spray is unbounded; with lockoutThreshold = 50 the attacker still gets 49 attempts per account per observation window, which is more than enough for a single common password. Step 4: Credential validation and lateral movement. The first hit gives the attacker a valid domain user. From there the playbook diverges into Kerberoasting (ADKERB-001), AS-REP roasting (ADKERB-002), BloodHound graph traversal to Tier 0, or direct lateral movement to workstations where a higher-privilege user is logged on. Step 5: NTDS extraction and offline crack. Once Domain Admin is reached, the attacker dumps NTDS.dit via ntdsutil ifm, vssadmin shadow copy, or DCSync (Impacket secretsdump.py, Mimikatz lsadump::dcsync). The resulting hashes are loaded into hashcat -m 1000 with a wordlist plus rule set. Every account whose password was at the Default Domain Policy floor cracks: at 8 characters complexity-enabled, expect 60 to 90 percent recovery within 24 hours on a single RTX 4090. Step 6: Long-term persistence. The attacker harvests cleartext passwords from the crack run and re-uses them across the environment, against VPN, against cloud SaaS, and against personal accounts of the affected users for phishing pivots. Weak Default Domain Policy therefore expands the blast radius of any single Domain Controller compromise into a long-tail credential leak that survives the initial incident.
Cómo lo evalúa Guerrilla
Guerrilla calls Get-ADDefaultDomainPasswordPolicy and additionally reads the domain naming-context head via Get-ADObject -Identity (Get-ADDomain).DistinguishedName -Properties minPwdLength, pwdHistoryLength, maxPwdAge, minPwdAge, pwdProperties, lockoutThreshold, lockoutDuration, lockoutObservationWindow. The raw FILETIME values (maxPwdAge, minPwdAge, lockoutDuration, lockoutObservationWindow) are converted from Windows tick intervals to TimeSpan for comparison. pwdProperties is decomposed bit-by-bit and each flag is reported individually. The check then evaluates each parsed value against the hardened baseline and emits a per-setting Pass / Fail with the observed and recommended values side by side. To detect coverage gaps, the check also enumerates Fine-Grained Password Policies via Get-ADFineGrainedPasswordPolicy -Filter * and resolves msDS-PSOAppliesTo to determine which principals are exempted from the Default Domain Policy. Accounts in privileged groups (Domain Admins, Enterprise Admins, Schema Admins) that are not covered by a stronger FGPP are flagged as elevated risk. The check is read-only, requires only authenticated user rights to the domain object, and produces no Event 4738 or 4739 noise.
Valor recomendado
Longitud mínima de 14 caracteres, complejidad habilitada, antigüedad máxima de 365 días, antigüedad mínima de 1 día, historial de 24 contraseñas
Remediación
Revise la Default Domain Policy con Get-ADDefaultDomainPasswordPolicy. Configúrela mediante la Administración de directivas de grupo: Default Domain Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy. Establezca los valores según los requisitos de seguridad de la organización
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1)
- CIS Benchmark
- 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5
- ANSSI
- R34
- CIS AD Benchmark
- 5.1.1
- MITRE ATT&CK
- T1110.001, T1110.003