Closed manulalath closed 2 years ago
Hi @manulalath , I am not sure which exact command do you have in mind. The Set-SamAccountPasswordHash
cmdlet only sets NT hashes, which are definitely not salted. The Set-ADDBAccountPasswordHash
cmdlet also sets Kerberos AES keys, including the salt, which is then sent by the KDC to the client, so there is no issue either.
Thanks @MichaelGrafnetter , I indeed use Get-ADReplAccount to test the password quality in cross forest domains. Want to understand cross forest password quality checks works 100% when one of the domain or some case both domain passwords are salted? Appreciate your response.
OK, now I understand the question. The Test-PasswordQuality
cmdlet only compares NT hashes, which are NOT salted. So no problem there. Sample code:
$accountsA = Get-ADReplAccount ...
$accountsB = Get-ADReplAccount ...
@($accountsA + $accountsB) | Test-PasswordQuality ...
Make sense, thanks @MichaelGrafnetter
Hello There,
How this tools works when the AD password is salted especially during cross forest password quality test.
Thanks Manu.