lithnet/ad-password-protection

List of banned words

fmoyay opened this issue · 5 comments

fmoyay commented

Hello,

I would like to know how can we get a list of banned words added in the store? We want to check the list to remove or add new words.

Another question: if the list of banned words is empty in the store wouldn't any restriction apply when a user changes his password?

Thank you

ryannewington commented

The words are hashed in the store so you can't obtain a list. You can use the Test-IsBannedWord cmdlet to validate if a specific word is in the store.

If there are no banned words in the store then the password will never be rejected based on that condition.

fmoyay commented

Hello again,

Ok, I have a test environment and I'd like to know what words we've added, but if that's not possible, the simplest option is to create a new store and start over.

Thank you very much Ryan!!

fmoyay commented

What if we don't install the application on all domain controllers? Wouldn't the forbidden word apply to users logging in against that DC?

Thank you once more.

ryannewington commented

Any writable DC in the domain could potentially process a password change. You'd end up with inconsistent application of policy when a user password change request ends up being processed on a DC without LPP installed.

To be effective it must be installed on all DCs

fmoyay commented

Ok

Thank you very much for your help!!