AD-PWDPOL-01 - Password history count should be retrievable

Contributed by Michael Soule with Merill FernandoAll contributors →

Overview

Password history is a critical security control that prevents users from reusing their recent passwords. Without adequate password history:

• Password cycling: Users can quickly cycle through passwords to return to their favorite (often compromised) password
• Compromised credential reuse: If a password is breached, users may inadvertently reintroduce it into the environment
• Weak compliance: Many compliance frameworks require password history to prevent password reuse

The recommended minimum of 24 remembered passwords ensures that users cannot reuse passwords within a reasonable timeframe, forcing them to create truly unique passwords.

Security Recommendation

Configure the password history count to at least 24 (Microsoft and CIS recommendation). This prevents users from reusing their last 24 passwords, significantly reducing the risk of password reuse attacks.

To configure this setting:

1. Open Active Directory Domains and Trusts or Group Policy Management
2. Navigate to the Default Domain Policy
3. Edit: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy
4. Set Enforce password history to 24 or more

How the Test Works

This test retrieves the default domain password policy using Get-ADDefaultDomainPasswordPolicy and extracts the PasswordHistoryCount value. The test reports:

• Current password history count
• Recommended minimum (24)
• Whether the configuration meets security best practices

Related Tests

• Test-MtAdPasswordMaxAge - Checks maximum password age
• Test-MtAdPasswordMinLength - Checks minimum password length
• Test-MtAdPasswordComplexityRequired - Checks if password complexity is enforced

Test Metadata

Field	Value
Test ID	AD-PWDPOL-01
Severity	Info
Suite	Active Directory
Category	AD.PasswordPolicy
PowerShell test	Test-MtAdPasswordHistoryCount
Tags	AD, AD-PWDPOL-01, AD.PasswordPolicy

Source

• Pester test: tests/ad/passwordpolicy/Test-MtAdPasswordHistoryCount.Tests.ps1
• PowerShell source: powershell/public/ad/passwordpolicy/Test-MtAdPasswordHistoryCount.ps1