When we talk about managing security in a corporate network, the Achilles' heel is often, without a doubt, the handling of credentials. It's a fact that cybercriminals don't always use sophisticated techniques; sometimes, a simple method is enough. brute force attack or the simple act of guessing common patterns to infiltrate a system and start moving laterally through the infrastructure until you hit the jackpot.
To prevent our network from becoming a sieve, it's essential to configure Active Directory so that passwords are not a game. It's not just about setting a minimum length, but about... implement a comprehensive strategy that combines strict directives, secure storage of hashes and, above all, constant education so that employees don't end up sticking a post-it note with the key on the monitor.
How are keys stored in the Windows ecosystem?
Windows does not store passwords in plain text (that would be digital suicide), but instead uses one-way functions, better known as cryptographic hashesBasically, it's a mathematical operation that transforms the key into a string of characters that cannot be reversed. In Active Directory domains, two main types are used: the LM (LAN Manager) OWF and the NT OWF.
The LM system is now an outdated system maintained for compatibility reasons, as it divides the key into two 7-byte blocks and is quite vulnerable. On the other hand, the NT hash uses the MD4 algorithm and it's the standard for authentication in modern domains. It's important to know that these keys reside in the file NTDS.DIT from the AD database, protected by encryption layers such as AES-256 in the latest versions of Windows Server.
In addition to the central database, there is local SAM on the equipment and the cached credentialsThese latter ones allow a user to log in even if the computer has lost connection with the domain controller, based on a hash derived from the username and the NT OWF.
Configuring password policies: Step by step
To bring order to the chaos, we can manage the keys from the Group Policy Management Console (GPMC). Navigating through Computer Configuration > Security Settings > Account Policies, we can define the rules of the game for the entire domain.
- Length and complexity: Eight characters are no longer enough. Organizations like INCIBE suggest a minimum of 12 charactersComplexity should be enabled to enforce the use of uppercase letters, lowercase letters, numbers, and symbols.
- History and validity: To prevent the user from switching between two similar passwords, it is recommended to history of 24 passwordsRegarding the expiration date, a maximum validity of about 45 days can be established to force renewal.
- Account blocking: To stop password spraying, it is vital to configure the blocking threshold (for example, 8 failed attempts) and define a waiting time, such as 30 minutes, before the account unlocks itself or requires administrator intervention.
Fine Granularity Directives (FGPP)
Not all users have the same level of risk. A receptionist doesn't need the same policy as a system administrator with elevated privilegesFor this purpose, there are Fine-Grade Password Policies (FGPP), available since Windows Server 2008.
These are managed through the Active Directory Administration Center (ADAC)Specifically, in the Password Configuration container. Here we can create a Password Configuration Object (PSO) and assign it to a specific security group, such as a group called gs_workersIn this way, we can require administrators to use much longer and more complex passwords than the rest of the staff.
Difference between passwords and passphrases
Sometimes we get obsessed with using strange symbols that no one remembers, when true strength lies in length. This is where the passphrasesUnlike a traditional key, a phrase is a string of long words that usually include spaces.
They are much more difficult to decipher using computers because the the search space is immenseFurthermore, they are easier for humans to remember, reducing the likelihood that the user will write the key down in an unsafe place. To prevent the generation of LM hashes (the weakest), an effective technique is create strong passwords forcing the keys to exceed the 14 characters.
Maintenance, auditing, and troubleshooting
Once the rules are implemented, it's necessary to monitor compliance. We can use commands like net accounts at the command prompt to view the current policy, or the command Get-ADDefaultDomainPasswordPolicy through PowerShell to obtain the domain details.
If a user complains that the new policy is not being applied to them, we can execute gpupdate / force to refresh the directives or use gpresult /r to analyze which GPOs are actually reaching the team. It's also crucial to monitor replication between domain controllers with repadmin /replsummarybecause a desynchronization can cause a user to be blocked on one server but not on another.
To avoid overwhelming employees with extreme restrictions, the use of third-party tools is recommended. open source password managers They allow the use of unique and strong keys without having to memorize them all, while systems of password reset (SSPR) They prevent the technical support service from being overwhelmed with calls every time someone forgets their password.
Identity security in Active Directory depends on a balance between technical robustness, the use of modern hashes such as NT and AES-256, the application of granular policies based on user risk, and the implementation of additional measures such as multi-factor authentication (MFA)which acts as the ultimate barrier when the password fails.
