So I do a lot of work creating AD users for different companies. One of the biggest and simplest things is determining what to use for passwords.
The worst thing you can do is to use a “default” passwords for new users and then have them change it when they first login. By default, users can read Active Directory (** gasp **). What that means is that average users can view most user information including when they were created. So, if I was a bad person (which I am not) I would simply check for new users and since the company gave me a “default” password for new users, I would simply try logging in as new users with the default password. So for those companies that have a “default” password – stop it.
Other companies generate a new random password for users. Some based on a predefined list of “safe” words and then adding random symbols and numbers to the end because it’s easy to remember simple words plus a few characters at the end.
My preferred method is really two lines of PowerShell.
Add-Type -AssemblyName System.Web
[System.Web.Security.Membership]::GeneratePassword(10,4)
And Voila – new password! (To see this on an MSDN page, click here.)
Awesome. But that doesn’t always work with everybody’s Active Directory, so I had to add some logic. For example, how long do you want the password to be? How complex do you want the password to be? And then I realized that the password generated, does not always meet AD requirements because some of the other passwords returned didn’t match the default complexity for Active Directory, such as 1 lower case, 1 upper case, 1 number and a complex character.
So I had to add logic to make sure that at least those criteria is met.
So my little two lines became longer and I turned it into a function to use over and over depending on the current environment, I can modify the length of the password and how many special characters are included. Then I added a switch to check if it meets AD requirements.
To see the complete code, click here.
