Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A user tries to change his/her password in a Windows domain and it's not accepted:

The password supplied does not meet the minimum complexity requirements

How can an end-user find out what the requirements are? (The obvious solution would be to contact IT but let's say it's not possible)

share|improve this question
    
If there is an AD in place, who manages it and why can't they be contacted? –  Dave M Dec 6 '11 at 15:23
1  
@Dave: it's a theoretical question :) I'm just curious if it can be done –  Siim K Dec 6 '11 at 15:26
    
Not always so theoretical, having been trying to help an end user with this exact problem when the sysadmin was on vacation... It's a pretty big design flaw that Windows doesn't tell the user what the complexity requirements are during the password change process. –  Brian Knoblauch 2 days ago

3 Answers 3

up vote 1 down vote accepted

Every AD user can see the value of the attribute named "pwdProperties", your id probably set to "DOMAIN_PASSWORD_COMPLEX" (value "1", integer).

AdFind can be used to retrieve many attributes relative to passwords:

AdFind.exe -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties

Here is an example of what you'll get:

AdFind V01.45.00cpp Joe Richards (joe@joeware.net) March 2011

Using server: domain.example.org:389 Directory: Windows Server 2008 R2 Base DN: DC=domain,DC=example,DC=org

dn:DC=domain,DC=example,DC=org

lockoutDuration: -18000000000
lockOutObservationWindow: -18000000000
lockoutThreshold: 0
maxPwdAge: -344736000000000
minPwdAge: 0
minPwdLength: 7
pwdProperties: 1
pwdHistoryLength: 2

1 Objects returned


share|improve this answer

I don't believe, short of brute force attempts, that there's any way programmatically to do this unless you're already an admin. So, you'll have to call IT. (The defaults vary depending on what they've got set up, although if you know that I guess you could look up the defaults and try. No guarantee that they haven't changed it, of course.)

share|improve this answer

Since it is AD, currently there is only a single complexity (per se) pattern available. The so called 3 of 4 pattern. It is either on, or off, unless you use a third party tool like Spec Ops, of the like to enforce some other level of complexity.

Three of Four means your password needs to include at least one character from the 4 possible character sets.

UPPER CASE lower case numeric (0-9) comic book curse words (aka Special characters, !@#$%^&())_+ etc)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.