Weak Password Policy via SMB

Weak password policy tells you whether the environment tolerates poor passwords and whether lockout pressure is low enough that password attacks become more realistic. rpcclient supports domain password policy queries, and null sessions can sometimes leak this data without authentication. See SMB Null Session Enumeration for the anonymous access path.

getdompwinfo returns the raw password policy fields: minimum password length, password history count, maximum password age, lockout threshold, lockout duration, and lockout observation window. A minimum length of 7 or less is notable. A history count under 10 makes password reuse more likely. Focus on the lockout threshold first. A value of 0 means no lockout applies. That changes the threat model considerably.

Start with a null session attempt.

Enumerating SMB Password Policy

Key policy fields to check:

• Minimum password length (7 or less is weak)
• Password history count (under 10 enables reuse)
• Lockout threshold (0 means no lockout, safe to spray)
• Lockout duration and observation window
• Maximum password age

If the domain allows anonymous RPC access, you get the policy without credentials. That itself is a finding. Note it before moving on. Then try with valid credentials to confirm the same values.

Then confirm with broader tooling if you have credentials. enum4linux-ng wraps several RPC calls and surfaces the password policy in its output under a dedicated section. nxc smb --pass-pol contacts the target over SMB and prints the policy fields directly. Both tools use the same underlying RPC calls as rpcclient. Use them as a cross-check when rpcclient output looks incomplete or when you want formatted output for reporting.

Watch the lockout observation window alongside the lockout threshold. A short observation window resets the counter quickly. That can make credential guessing viable even when the threshold looks restrictive on paper.

What matters is the policy, not the fact that you could enumerate it. A low minimum password length, weak history, or no meaningful lockout threshold changes how you assess authentication risk on the host or domain. A high or missing lockout threshold can make password spraying more viable in a controlled engagement: see AD Password Spraying and AD Password Policy and Spray Surface. A strict lockout policy pushes you away from broad guessing and toward other paths.

If anonymous access returns policy data, keep that too. It shows the environment leaks useful authentication context before login.

These tools commonly fail when the target restricts anonymous RPC access and you have no credentials yet. In that case, obtain a hash through SMB relay or NTLM capture first, then use credentials for the policy query. Non-domain hosts running SMB may not expose a domain policy at all. The local SAM policy applies instead. Workstations typically have weaker local policies than the domain enforces.

Document the full policy fields, not just the lockout threshold. Auditors and clients care about minimum length and history as standalone findings. A threshold of 0 combined with a short minimum length is worth flagging as a compound weakness.