Service Overview
The Active Directory Password Hygiene Assessment evaluates password strength and usage trends within an organization's AD environment. This process offers insights into commonly used weak passwords and supports the creation of a tailored blocklist to reduce predictable password patterns.
Examples of frequently used passwords include:
Company name + year
Season + year
Month + year
Methodology
Using customized tools and word lists, CYE generates a dictionary (hash table) and compares it to the domain user NTLM hashes provided by the client’s IT security team.
The assessment follows this process:
A tentative one-hour session is scheduled in case issues occur during NTLM hash extraction
IT personnel run provided scripts to extract user NTLM hashes
The resulting file is compressed and encrypted using a strong password (minimum 32 characters, including 4 character types)
The encrypted file is sent to CYE via email; the encryption password is shared through a separate channel (e.g., instant messaging such as WhatsApp)
CYE performs the password analysis and prepares a summary report
Deliverables
A detailed report listing cracked passwords
Summary analysis of password reuse across the organization
Prerequisites
NTLM hashes must be extracted by IT personnel with domain admin permissions
CYE provides scripts to support the extraction process
Customer Engagement
Coordination with an IT representative is required to perform NTLM hash extraction and communicate securely during the process
Relevant Standards
MITRE ATT&CK framework
Internal methodologies developed through previous CYE assessments
Security Domains Covered
Identity management and remote access
Cross-organization policies, procedures, and governance