ADPWD-001: Default Domain Password Policy
- Plataforma
- Active Directory
- Categoría
- AD Password & Lockout Policies
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check binds to the default naming context root (for example DC=contoso,DC=local) and reads the following LDAP attributes on the domain object itself, which is where Default Domain Policy values are persisted: minPwdLength (minimum password length in characters), pwdHistoryLength (number of remembered prior passwords), maxPwdAge (maximum password age as a Windows FILETIME negative value), minPwdAge (minimum password age before a user may change it again), pwdProperties (bitmask: bit 0x1 = DOMAIN_PASSWORD_COMPLEX, bit 0x2 = DOMAIN_PASSWORD_NO_ANON_CHANGE, bit 0x4 = DOMAIN_PASSWORD_NO_CLEAR_CHANGE, bit 0x8 = DOMAIN_LOCKOUT_ADMINS, bit 0x10 = DOMAIN_PASSWORD_STORE_CLEARTEXT, bit 0x20 = DOMAIN_REFUSE_PASSWORD_CHANGE), lockoutThreshold (bad-password count before lockout), lockoutDuration (how long the account stays locked), and lockoutObservationWindow (the rolling window in which bad-password counts accumulate). Each value is compared against the hardened baseline: minPwdLength greater than or equal to 14, pwdHistoryLength greater than or equal to 24, maxPwdAge less than or equal to 365 days, minPwdAge greater than or equal to 1 day, complexity (pwdProperties bit 0x1) enabled, store-cleartext (bit 0x10) disabled, lockoutThreshold between 5 and 10, lockoutDuration greater than or equal to 15 minutes, lockoutObservationWindow greater than or equal to 15 minutes. The check also enumerates any Fine-Grained Password Policies via Get-ADFineGrainedPasswordPolicy to confirm whether stronger settings exist for privileged groups, since FGPP overrides the Default Domain Policy on a per-principal basis through msDS-PSOApplied.
Por qué importa
The Default Domain Policy is the password floor for the entire forest path that touches this domain. If the floor is low, every account that is not explicitly raised by a Fine-Grained Password Policy lives under that low floor, including service accounts, helpdesk accounts, shared admin accounts, and the long tail of users who chose the shortest password the policy would accept. Three concrete attack surfaces expand directly with a weak Default Domain Policy. First, online password spraying: with lockoutThreshold disabled (0) or set very high (greater than 50), an attacker who has scraped usernames from OWA, Teams, or LDAP can attempt one or two passwords per account per observation window across the entire user population without ever locking an account, and a single weak password (Spring2026!, Welcome1, Password123) typically yields a foothold within the first sweep. Second, offline cracking of NTDS.dit: once an attacker has Domain Controller access (DCSync, VSS shadow copy, restore from backup), they extract the NT hashes for every account and run hashcat. The crack rate is determined entirely by minPwdLength and complexity. At 8 characters with complexity disabled, 100 percent of hashes fall in hours on commodity GPU hardware; at 14 characters with complexity enabled the practical recovery rate drops by orders of magnitude. Third, AS-REP roasting and Kerberoasting: both techniques produce offline-crackable material whose viability is bounded by the password policy applied to the target account. A weak Default Domain Policy directly determines how long the resulting RC4-TGS or AS-REP hash survives a hashcat run. Microsoft Defender for Identity, Mandiant M-Trends, and the Verizon DBIR consistently list weak or absent password policy as a top-five root cause of identity-tier compromise.
Ruta de ataque
Step 1: Reconnaissance. The attacker, holding any valid domain credential (intern, contractor, harvested via phishing), runs Get-ADDefaultDomainPasswordPolicy or queries the domain object via LDAP for minPwdLength and lockoutThreshold. PowerView Get-DomainPolicy, BloodHound collection, and Impacket samrdump.py all expose the values without elevated privileges. Step 2: Username harvesting. The attacker enumerates the user population via LDAP (Get-ADUser -Filter *), Azure AD / Entra ID UserPrincipalName scraping, GAL extraction from compromised Exchange, or username generation from the company directory. A typical mid-size enterprise yields 2,000 to 20,000 candidate usernames. Step 3: Password spray. The attacker selects a low-entropy candidate (Season+Year, Company+Number, Welcome1, P@ssw0rd) and authenticates against an exposed endpoint: Kerberos pre-auth (Rubeus, kerbrute), LDAP simple bind, NTLM via SMB or HTTP, Azure AD / Entra ID sign-in, OWA, Autodiscover, or RDP. With lockoutThreshold = 0 the spray is unbounded; with lockoutThreshold = 50 the attacker still gets 49 attempts per account per observation window, which is more than enough for a single common password. Step 4: Credential validation and lateral movement. The first hit gives the attacker a valid domain user. From there the playbook diverges into Kerberoasting (ADKERB-001), AS-REP roasting (ADKERB-002), BloodHound graph traversal to Tier 0, or direct lateral movement to workstations where a higher-privilege user is logged on. Step 5: NTDS extraction and offline crack. Once Domain Admin is reached, the attacker dumps NTDS.dit via ntdsutil ifm, vssadmin shadow copy, or DCSync (Impacket secretsdump.py, Mimikatz lsadump::dcsync). The resulting hashes are loaded into hashcat -m 1000 with a wordlist plus rule set. Every account whose password was at the Default Domain Policy floor cracks: at 8 characters complexity-enabled, expect 60 to 90 percent recovery within 24 hours on a single RTX 4090. Step 6: Long-term persistence. The attacker harvests cleartext passwords from the crack run and re-uses them across the environment, against VPN, against cloud SaaS, and against personal accounts of the affected users for phishing pivots. Weak Default Domain Policy therefore expands the blast radius of any single Domain Controller compromise into a long-tail credential leak that survives the initial incident.
Cómo lo evalúa Guerrilla
Guerrilla calls Get-ADDefaultDomainPasswordPolicy and additionally reads the domain naming-context head via Get-ADObject -Identity (Get-ADDomain).DistinguishedName -Properties minPwdLength, pwdHistoryLength, maxPwdAge, minPwdAge, pwdProperties, lockoutThreshold, lockoutDuration, lockoutObservationWindow. The raw FILETIME values (maxPwdAge, minPwdAge, lockoutDuration, lockoutObservationWindow) are converted from Windows tick intervals to TimeSpan for comparison. pwdProperties is decomposed bit-by-bit and each flag is reported individually. The check then evaluates each parsed value against the hardened baseline and emits a per-setting Pass / Fail with the observed and recommended values side by side. To detect coverage gaps, the check also enumerates Fine-Grained Password Policies via Get-ADFineGrainedPasswordPolicy -Filter * and resolves msDS-PSOAppliesTo to determine which principals are exempted from the Default Domain Policy. Accounts in privileged groups (Domain Admins, Enterprise Admins, Schema Admins) that are not covered by a stronger FGPP are flagged as elevated risk. The check is read-only, requires only authenticated user rights to the domain object, and produces no Event 4738 or 4739 noise.
Valor recomendado
Minimum length 14 characters, complexity enabled, maximum age 365 days, minimum age 1 day, history 24 passwords
Remediación
Review the Default Domain Policy using Get-ADDefaultDomainPasswordPolicy. Configure via Group Policy Management: Default Domain Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy. Set values per organizational security requirements
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1)
- CIS Benchmark
- 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5
- ANSSI
- R34
- CIS AD Benchmark
- 5.1.1
- MITRE ATT&CK
- T1110.001, T1110.003