Skip to content
HackIndex logo

HackIndex

Password Policy and Spray Surface

3 min read Apr 30, 2026

Reading the domain password policy before any credential attack is mandatory. A single miscounted attempt against a locked-out account wastes a credential and generates noise. The policy tells you the lockout threshold, the observation window that resets the counter, and the minimum password length that shapes your wordlist choices.

Read the domain password policy

nxc reads the default domain password policy directly over SMB without any additional modules.

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD --pass-pol 
SMB  10.10.10.10  445  DC01  [+] Dumping password policy
SMB  10.10.10.10  445  DC01  Minimum password length: 8
SMB  10.10.10.10  445  DC01  Password complexity: Enabled
SMB  10.10.10.10  445  DC01  Maximum password age: 42 days
SMB  10.10.10.10  445  DC01  Minimum password age: 1 day
SMB  10.10.10.10  445  DC01  Reset Account Lockout Counter: 30 minutes
SMB  10.10.10.10  445  DC01  Locked Account Duration: 30 minutes
SMB  10.10.10.10  445  DC01  Account Lockout Threshold: 5
SMB  10.10.10.10  445  DC01  Forced Log off Time: Not Set
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object "DC=$DOMAIN_PART1,DC=$DOMAIN_PART2" --attr minPwdLength maxPwdAge minPwdAge lockoutThreshold lockoutObservationWindow lockoutDuration pwdProperties 
minPwdLength: 8
lockoutThreshold: 5
lockoutObservationWindow: -18000000000
lockoutDuration: -18000000000

Lockout observation window and lockout duration are stored as negative 100-nanosecond intervals. Divide the absolute value by 10,000,000 to get seconds. A value of -18000000000 equals 1800 seconds — 30 minutes. This is the window within which failed attempts accumulate toward the lockout threshold.

Key values to note before spraying:

  • lockoutThreshold — number of failures before lockout. A value of 0 means no lockout policy is set.

  • lockoutObservationWindow — the counter resets after this period with no new failures.

  • minPwdLength — eliminates any candidate password shorter than this value from your list.

Fine-grained password policies

Fine-grained password policies (PSOs) override the default domain policy for specific users or groups. A service account with a PSO may have a higher lockout threshold or no lockout at all. Always check for PSOs before spraying specific accounts.

┌──(kali㉿kali)-[~]
└─$ # Find all PSO objects
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(objectClass=msDS-PasswordSettings)' --attr name msDS-MinimumPasswordLength msDS-LockoutThreshold msDS-LockoutObservationWindow msDS-PSOAppliesTo
 
┌──(kali㉿kali)-[~]
└─$ # ldapsearch equivalent
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=Password Settings Container,CN=System,$BASE_DN" "(objectClass=msDS-PasswordSettings)" name msDS-MinimumPasswordLength msDS-LockoutThreshold msDS-PSOAppliesTo 
name: ServiceAccountPolicy
msDS-MinimumPasswordLength: 12
msDS-LockoutThreshold: 0
msDS-PSOAppliesTo: CN=Service Accounts,OU=Groups,DC=corp,DC=local

A PSO with msDS-LockoutThreshold: 0 on a group means those accounts have no lockout — they can be sprayed without any timing constraint. A PSO with a higher threshold than the default domain policy means you have more attempts per observation window against those accounts.

With the policy read, move to Password Spraying using the threshold and observation window to set safe spray timing.

References