search

lithnet / ad-password-protection

Active Directory password filter featuring breached password checking and custom complexity rules
MIT License
490 stars 52 forks source link

duplicate logging of password change attempts on DC #63

Closed mer0llac0aster closed 3 years ago

mer0llac0aster commented 3 years ago

Environment: 1 DC (Server 2019, 2016 functional level) 1 Windows 10 20H2 endpoint Lithnet installed with HIBP database and BannedWords list GPO configured and applied All systems rebooted

Steps to reproduce: Step 1. Lithnet logs startup message to Application log on boot up.

Step 2. Attempt to set a bad password (banned word normalized) on the DC with ADUC.

Outcome: i get 4 total events every time i attempt to set the bad password. Event ID 4 followed by Event ID 8205 followed by another Event ID 4 followed again by a second Event ID 8205 image

ryannewington commented 3 years ago

@mer0llac0aster this one is a known issue. It's not a fault with LPP as far as I can tell. Windows is sending the password through twice.

stale[bot] commented 3 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs.