Password complexity should be enabled
AD-PWDPOL-04MediumActive DirectoryPassword policy
Part of Active Directory · Active Directory · Password policy · All checks
Invoke-Maester -TestId AD-PWDPOL-04Overview
Section titled “Overview”Password complexity requirements are a fundamental security control that helps prevent weak passwords:
- Prevents common passwords: Complexity requirements block easily guessable passwords like “password123” or “companyname2024”
- Increases entropy: Character diversity increases the search space for brute-force attacks
- Meets compliance requirements: Most security frameworks require password complexity
Complexity alone is not sufficient—length is equally important. The best approach combines both: long passwords (14+ characters) with complexity requirements.
Control Type
Section titled “Control Type”Preventive
Security Recommendation
Section titled “Security Recommendation”Enable password complexity requirements to ensure passwords contain characters from at least three of these categories:
- Uppercase letters (A-Z)
- Lowercase letters (a-z)
- Numbers (0-9)
- Special characters (!@#$%^&*, etc.)
To configure this setting:
- Open Group Policy Management
- Navigate to the Default Domain Policy
- Edit: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy
- Enable Password must meet complexity requirements
How the Test Works
Section titled “How the Test Works”This test retrieves the default domain password policy using Get-ADDefaultDomainPasswordPolicy and checks the ComplexityEnabled property. The test reports:
- Whether complexity is currently enabled or disabled
- Recommended setting (Enabled)
- Whether the configuration meets security best practices
Related Tests
Section titled “Related Tests”Test-MtAdPasswordHistoryCount- Checks password history enforcementTest-MtAdPasswordMaxAge- Checks maximum password ageTest-MtAdPasswordMinLength- Checks minimum password length
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-PWDPOL-04 |
| Severity | Medium |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Password policy |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1110 Brute Force |
| PowerShell test | Test-MtAdPasswordComplexityRequired |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS.pwdProperties:ReadProperty |