Lithnet Password Protection

Lithnet Password Protection is a module for Active Directory servers that inspects passwords as users change them. It uses a password filter to reject or approve password changes based on policies you define in group policy, helping enforce strong passwords across AD accounts.

It can block compromised passwords, banned words, regex-based rules, and points-based complexity. You can set length-based policies, import the HIBP data set or other plain-text passwords and NTLM hashes, audit existing passwords against compromised lists, and create detailed event logs. Passwords never leave the domain controller.

The PowerShell module can synchronize compromise lists from the haveibeenpwned.com API, add banned words and password lists, and test passwords and hashes. It is supported on x64 Windows Server 2012 R2 or higher, requires no additional servers, and uses a DFS-R friendly data store.