Password minimum length should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Password policy · All checks

Run this check

Invoke-Maester -TestId AD-PWDPOL-03

Overview

Minimum password length is one of the most effective controls against password-based attacks:

• Brute-force resistance: Each additional character exponentially increases the time required to brute-force a password
• Dictionary attack protection: Longer passwords are less likely to appear in common password dictionaries
• Modern standard: NIST and Microsoft now recommend longer passwords over complex character requirements

A minimum of 14 characters aligns with current NIST guidelines and provides significantly better security than the traditional 8-character minimum. Passphrases (multiple words strung together) are an excellent way to achieve length while maintaining memorability.

Control Type

Preventive

Security Recommendation

Configure the minimum password length to at least 14 characters (NIST SP 800-63B recommendation). Consider:

• Using passphrases instead of complex passwords
• Combining length with complexity for maximum security
• Educating users on creating memorable long passwords

To configure this setting:

1. Open Group Policy Management
2. Navigate to the Default Domain Policy
3. Edit: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy
4. Set Minimum password length to 14 or more

How the Test Works

This test retrieves the default domain password policy using Get-ADDefaultDomainPasswordPolicy and extracts the MinPasswordLength value. The test reports:

• Current minimum password length
• Recommended minimum (14 characters)
• Whether the configuration meets security best practices

Related Tests

• Test-MtAdPasswordHistoryCount - Checks password history enforcement
• Test-MtAdPasswordMaxAge - Checks maximum password age
• Test-MtAdPasswordComplexityRequired - Checks if password complexity is enforced

Details

Every attribute of this check

Field	Value
Test ID	AD-PWDPOL-03
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Password policy
Area	Authentication
Resource type	Tenant
MITRE ATT&CK	T1110 Brute Force
PowerShell test	Test-MtAdPasswordMinLength
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:domainDNS.minPwdLength:ReadProperty

Source

• Test: tests/ad/password-policy/Test.AD-PWDPOL-03.ps1
• Documentation: tests/ad/password-policy/Test.AD-PWDPOL-03.md