Password Cracking in AD: The Fun Part of Compliance

The talk follows three fictional organizations, each with a different approach to password compliance, to show how the same policy rules hold up against an attacker. It opens with a common scenario: an internet-facing login is brute forced and password sprayed within hours of going online. One company is protected by multi-factor authentication and raises alerts, while the other is breached and its credential store is dumped.

The middle section compares PCI DSS, GDPR and NIST SP 800-63B guidance on password length, rotation and complexity. A cracking time table is used to show why longer passphrases without forced rotation can outlast short complex passwords. The speaker then demonstrates a self-audit workflow: a low-privilege service account replicates directory data, hashes are cracked on a schedule using hashcat with rules and PRINCE mode, and accounts with weak passwords are forced to change. Duplicate hashes across different accounts are flagged as either guessable passwords or a broken provisioning process. The same approach is shown for Entra ID using AADInternals, and cracked words are added to banned-password lists.

The closing point is that following standards blindly does not improve security, while applying them intelligently with user training and regular self-testing can. Practical advice includes storing long random passwords in a manager, using memorable long passphrases where typing is unavoidable, and rolling out policy changes in waves rather than all at once.