Policies, Securing, Cracking, and More

Derek Melber starts from the premise that passwords will remain in Windows environments, especially for service accounts that cannot use multi-factor authentication. He explains how Active Directory password policy really applies: it must be linked to the domain to govern domain users, while a policy linked to an organizational unit only reaches local accounts on the computers inside it. Fine-grained password policy objects allow different rules for different groups, ordered by priority, and he shows a PowerShell check to reveal the policy a user actually receives.

The talk then contrasts this with Entra ID, where most password settings cannot be tuned. Defaults include an eight-character minimum and no expiry unless enabled, plus a banned-word list maintained by Microsoft and a custom list capped at 1,000 words. On the attack side he covers phishing, pass-the-hash and ticket abuse, and password spraying versus brute force, including how lockout thresholds can be exploited. He demonstrates cracking with dictionary, brute-force and rainbow-table methods.

He closes with defensive advice: disable LM and NTLMv1 where possible, since NTLMv2 and Kerberos are hard to remove. Length matters most, so passphrases of 20 or more characters are preferable, and security teams should make sure password spraying reaches their monitoring.