Password history count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Password policy · All checks

Run this check

Invoke-Maester -TestId AD-PWDPOL-01

Overview

Password history is a critical security control that prevents users from reusing their recent passwords. Without adequate password history:

• Password cycling: Users can quickly cycle through passwords to return to their favorite (often compromised) password
• Compromised credential reuse: If a password is breached, users may inadvertently reintroduce it into the environment
• Weak compliance: Many compliance frameworks require password history to prevent password reuse

The recommended minimum of 24 remembered passwords ensures that users cannot reuse passwords within a reasonable timeframe, forcing them to create truly unique passwords.

Control Type

Operational

Security Recommendation

Configure the password history count to at least 24 (Microsoft and CIS recommendation). This prevents users from reusing their last 24 passwords, significantly reducing the risk of password reuse attacks.

To configure this setting:

1. Open Active Directory Domains and Trusts or Group Policy Management
2. Navigate to the Default Domain Policy
3. Edit: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy
4. Set Enforce password history to 24 or more

How the Test Works

This test retrieves the default domain password policy using Get-ADDefaultDomainPasswordPolicy and extracts the PasswordHistoryCount value. The test reports:

• Current password history count
• Recommended minimum (24)
• Whether the configuration meets security best practices

Related Tests

• Test-MtAdPasswordMaxAge - Checks maximum password age
• Test-MtAdPasswordMinLength - Checks minimum password length
• Test-MtAdPasswordComplexityRequired - Checks if password complexity is enforced

Details

Every attribute of this check

Field	Value
Test ID	AD-PWDPOL-01
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Password policy
Area	Authentication
Resource type	Tenant
MITRE ATT&CK	T1110.004 Credential Stuffing
PowerShell test	Test-MtAdPasswordHistoryCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:domainDNS.pwdHistoryLength:ReadProperty

Source

• Test: tests/ad/password-policy/Test.AD-PWDPOL-01.ps1
• Documentation: tests/ad/password-policy/Test.AD-PWDPOL-01.md