Detections
Analytics

5.2.3.3 (L1) Ensure password protection is enabled for on-prem Active Directory

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Microsoft Entra Password Protection provides a global and custom banned password list. A password change request fails if there's a match in these banned password list. To protect on-premises Active Directory Domain Services (AD DS) environment, install and configure Entra Password Protection.

 Note : This recommendation applies to Hybrid deployments only and will have no impact unless working with on-premises Active Directory.

This feature protects an organization by prohibiting the use of weak or leaked passwords. In addition, organizations can create custom banned password lists to prevent their users from using easily guessed passwords that are specific to their industry. Deploying this feature to Active Directory will strengthen the passwords that are used in the environment.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remediate using the UI:

 - Download and install the Azure AD Password Proxies and DC Agents from the following location: https://www.microsoft.com/download/details.aspx?id=57071 After installed follow the steps below.

 - Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
 - Click to expand Protection select Authentication methods.
 - Select Password protection and set Enable password protection on Windows Server Active Directory to Yes and Mode to Enforced.

Impact:

The potential impact associated with implementation of this setting is dependent upon the existing password policies in place in the environment. For environments that have strong password policies in place, the impact will be minimal. For organizations that do not have strong password policies in place, implementation of Microsoft Entra Password Protection may require users to change passwords and adhere to more stringent requirements than they have been accustomed to.

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CSCv7|4.4

Plugin: microsoft_azure

Control ID: 4ef7da496cc12ca463427c2aa1df47e25720697fe15015f95df752c6b746fc7a