search

ryanries / PassFiltEx

PassFiltEx. An Active Directory Password Filter.
GNU General Public License v3.0
264 stars 50 forks source link

Make space as mandatory for AD Password Policy #25

Closed arunanmakudeeswaran closed 2 months ago

arunanmakudeeswaran commented 7 months ago

Hi @ryanries As part of security enhancement , we want to make space as mandatory in password. Is this possible through default MS settings in AD-GPO or can be achieved any other way ?

OftKilted commented 7 months ago

For reference, Spaces are considered special characters, as they’re defined as Symbols:

https://learn.microsoft.com/en-us/windows-server/security/kerberos/passwords-technical-overview

arunanmakudeeswaran commented 7 months ago

@OftKilted I agree with you, spaces are considered as special characters, but is that possible to make space mandatory for end users to use in their password?

When it comes to special characters, they are free to use spaces as one option, but still, they can choose other special characters as well, right!

OftKilted commented 7 months ago

You can’t force the use of a Space character natively.

As a side reference, enforcing a specific special character will decrease the security and complexity of your passwords. Because a malicious actor will know that they can remove any password that does not have a space in it from their complexity table.

As referenced in “[Policies] Weir, Matt, Sudhir Aggarwal, Michael Collins, and Henry Stern. “Testing Metrics for Password Creation Policies by Attacking Large Sets of Revealed Passwords.” In Proceedings of the 17th ACM Conference on Computer and Communications Security, 162–175. CCS ‘10. New York, NY, USA: ACM, 2010. doi:10.1145/1866307.1866327.”

Enforcing the kind of complexity requirement you want to enforce tend to make passwords overall weaker.

For more easily found reference I recommend the NIST 800-63b appendix: https://pages.nist.gov/800-63-3/sp800-63b.html#appA