Lion Cipher Lab

Audit Active Directory passwords with DSInternals before an attacker cracks them

• Identity & Access Management
• Intermediate
• ~50 min
• Free · no account required

Why it matters

When an attacker gets a foothold in an Active Directory, the prize they go for is the credential store. Every account's password in AD is kept as an NTLM HASH — a fixed-length fingerprint of the password produced by an unsalted MD4 over the (UTF-16) password. 'Unsalted' is the part that hurts: two accounts with the same password produce the exact same hash, and the hash never changes until the password does. Those hashes live in a single database file on every domain controller called NTDS.dit, and there are two well-worn ways an attacker lifts them — DCSync, where they abuse the directory…

What you'll learn

• defining the pieces before you touch them: what an NTLM hash is, what NTDS.dit is, what DCSync / directory replication does, what reversible encryption means, and what a 'duplicate password group' is
• installing the free, open-source DSInternals PowerShell module from the PowerShell Gallery and understanding exactly what it reads and why that is sensitive
• pulling account hashes two ways — live over replication with Get-ADReplAccount (needs DCSync rights) and offline from a copied NTDS.dit + SYSTEM hive with Get-ADDBAccount — and choosing the right one for the situation
• running Test-PasswordQuality and reading every category it reports: WeakPassword (breach-list hits), DuplicatePasswordGroups, ClearTextPassword / reversibly-encrypted, PasswordNeverExpires, and empty passwords
• building a TINY offline breach list for -WeakPasswordHashesSortedFile so the audit runs on a laptop, and knowing where the full free offline HaveIBeenPwned NTLM list comes from and how big it really is
• measuring a real fix: seed bad accounts, capture the BEFORE report, remediate (reset to unique strong passwords, disable reversible encryption, remove never-expires), then RE-RUN and watch the categories empty out
• judgment: when to run this (before an attacker does; after a suspected breach; on a schedule for hygiene), why DUPLICATE hashes are their own emergency (one crack unlocks every account that shares it), and the honest limits — a clean report is not proof of strong passwords
• treating the audit output as sensitive material and pairing this DETECTIVE control with a PREVENTIVE one (fine-grained password policy) instead of relying on either alone

Steps in this lab

1. The pieces: NTLM hashes, NTDS.dit, DCSync, and why the defender reads them first
2. Install DSInternals, and understand exactly what it reads
3. Seed the problems on purpose — so the BEFORE report has something to find
4. Build a tiny offline breach list — free, and no tens of GB
5. Pull the hashes and run the BEFORE audit
6. Remediate, then run the AFTER audit — the measurement
7. Do it better — when to run this, why duplicates are an emergency, and the honest limits

Open the full interactive lab →