# Password protection for on-premises is enabled
When on-premises password protection isn’t enabled or enforced, threat actors can use low-and-slow password spray with common variants, such as…
Source: https://maester.dev/docs/tests/ZTA.21847
:::note[Maester checks this too]
[CIS.M365.5.2.3.3](/docs/tests/CIS.M365.5.2.3.3) (Ensure password protection is enabled for on-prem Active Directory) checks the same setting. Running both reports it twice.
:::
## Overview
When on-premises password protection isn’t enabled or enforced, threat actors can use low-and-slow password spray with common variants, such as season+year+symbol or local terms, to gain initial access to Active Directory Domain Services accounts. Domain Controllers (DCs) can accept weak passwords when either of the following statements are true:
- Microsoft Entra Password Protection DC agent isn't installed
- The password protection tenant setting is disabled or in audit-only mode
With valid on-premises credentials, attackers laterally move by reusing passwords across endpoints, escalate to domain admin through local admin reuse or service accounts, and persist by adding backdoors, while weak or disabled enforcement produces fewer blocking events and predictable signals. Microsoft’s design requires a proxy that brokers policy from Microsoft Entra ID and a DC agent that enforces the combined global and tenant custom banned lists on password change/reset; consistent enforcement requires DC agent coverage on all DCs in a domain and using Enforced mode after audit evaluation.
## Remediation
- [Deploy Microsoft Entra password protection](https://learn.microsoft.com/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Password protection |
| Area | Authentication |
| ATT&CK | [T1110.003](/docs/tests?mitre=T1110.003) Password Spraying |
| Licence | P1 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.