# Password Policy and Spray Surface

> Enumerate AD password policies to identify weak settings and assess exposure to password spraying attacks across domain accounts.

- **URL:** https://hackindex.io/platforms/active-directory/vulnerability-discovery/ad-password-policy-and-spray-surface
- **Path:** Active Directory > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/platforms/active-directory/vulnerability-discovery.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

Reading the domain password policy before any credential attack is mandatory. A single miscounted attempt against a locked-out account wastes a credential and generates noise. The policy tells you the lockout threshold, the observation window that resets the counter, and the minimum password length that shapes your wordlist choices.

## Read the domain password policy

nxc reads the default domain password policy directly over SMB without any additional modules.

**Read password policy with nxc**

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD --pass-pol
# SMB  10.10.10.10  445  DC01  [+] Dumping password policy
# SMB  10.10.10.10  445  DC01  Minimum password length: 8
# SMB  10.10.10.10  445  DC01  Password complexity: Enabled
# SMB  10.10.10.10  445  DC01  Maximum password age: 42 days
# SMB  10.10.10.10  445  DC01  Minimum password age: 1 day
# SMB  10.10.10.10  445  DC01  Reset Account Lockout Counter: 30 minutes
# SMB  10.10.10.10  445  DC01  Locked Account Duration: 30 minutes
# SMB  10.10.10.10  445  DC01  Account Lockout Threshold: 5
# SMB  10.10.10.10  445  DC01  Forced Log off Time: Not Set
```

**Read password policy with BloodyAD**

```bash
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object "DC=$DOMAIN_PART1,DC=$DOMAIN_PART2" --attr minPwdLength maxPwdAge minPwdAge lockoutThreshold lockoutObservationWindow lockoutDuration pwdProperties
# minPwdLength: 8
# lockoutThreshold: 5
# lockoutObservationWindow: -18000000000
# lockoutDuration: -18000000000
```

Lockout observation window and lockout duration are stored as negative 100-nanosecond intervals. Divide the absolute value by 10,000,000 to get seconds. A value of `-18000000000` equals 1800 seconds: 30 minutes. This is the window within which failed attempts accumulate toward the lockout threshold.

Key values to note before spraying:

- **lockoutThreshold**: number of failures before lockout. A value of 0 means no lockout policy is set.
- **lockoutObservationWindow**: the counter resets after this period with no new failures.
- **minPwdLength**: eliminates any candidate password shorter than this value from your list.

## Fine-grained password policies

Fine-grained password policies (PSOs) override the default domain policy for specific users or groups. A service account with a PSO may have a higher lockout threshold or no lockout at all. Always check for PSOs before spraying specific accounts.

**Enumerate fine-grained password policies**

```bash
# Find all PSO objects
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(objectClass=msDS-PasswordSettings)' --attr name msDS-MinimumPasswordLength msDS-LockoutThreshold msDS-LockoutObservationWindow msDS-PSOAppliesTo

# ldapsearch equivalent
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=Password Settings Container,CN=System,$BASE_DN" "(objectClass=msDS-PasswordSettings)" name msDS-MinimumPasswordLength msDS-LockoutThreshold msDS-PSOAppliesTo
# name: ServiceAccountPolicy
# msDS-MinimumPasswordLength: 12
# msDS-LockoutThreshold: 0
# msDS-PSOAppliesTo: CN=Service Accounts,OU=Groups,DC=corp,DC=local
```

A PSO with `msDS-LockoutThreshold: 0` on a group means those accounts have no lockout: they can be sprayed without any timing constraint. A PSO with a higher threshold than the default domain policy means you have more attempts per observation window against those accounts.

With the policy read, move to [Password Spraying](https://hackindex.io/platforms/active-directory/exploitation/ad-password-spraying) using the threshold and observation window to set safe spray timing.

## References

- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - --pass-pol flag for SMB password policy enumeration
- [BloodyAD: GitHub](https://github.com/CravateRouge/bloodyAD) - Domain object attribute query for password policy and PSO enumeration