Extracting Password Hashes from Active Directory

Extracting hashes from Active Directory

To extract hashes from Active Directory you must first obtain a copy of the underlying Active Directory database; ntds.dit

For more information on the Data Store Architecture please refer to this Microsoft Technet article

Prerequisites

You must be logged on to a domain controller.

Extracting the Database

To extract . . . → Read More: Extracting Password Hashes from Active Directory

Active Directory Password Expiration Date

To find out the password expiration date for an Active Directory user you must first determine your domain’s password expiration policy and then when the password was last set.

Find your Domain Password Expiration Policy import-module activedirectory Get-ADDefaultDomainPasswordPolicy

Property MaxPasswordAge will tell you the default password expiration policy

Determine Date User Password Was Last Set . . . → Read More: Active Directory Password Expiration Date

active directory disable users older than x days

Script Details

This is example will show you how to disable folks that have a password older than x number of days AND / OR have not logged in for X number of days

Requirements ActiveRoles Management Shell (free) Powershell Server 2003 or Higher Domain Controller Example Script

Filename: C:\1audit\scripts\disable_accounts_password_age_greater_91_days.ps1 Description: (Disable users that have . . . → Read More: active directory disable users older than x days