Specops Password Policy

Specops Password Policy can be configured from any computer in the domain where the Specops Password Policy Administration Tools are installed. The administration tool can be used to configure different aspects of the product.

Domain Administration tool: The Domain Administration tool controls domain wide settings for Specops Password Policy.

Group Policy snap-in: Manages Specops Password Policy settings.

You can use the Domain Administration tool to manage configurations that apply to your entire domain. Once you have modified the settings, your changes are automatically saved.

You can access the Domain Administration tool via the start menu.

Current user information

In the bottom left of the Domain Adminstration tool, you can see information on the signed in user. It will show the current user's name, as well as the role that user is running as (Domain Admin or Specops Password Policy Admin Group).

Roles and permissions

As Domain Admin you can perform all tasks in Specops Password Policy. The Specops Password Policy Admin Group permissions are restricted to the following:

• Enable/disable SPP in the domain
• Edit some of the Domain Settings:
  • Configure SMTP and sending test emails for the SMTP configuration
  • Configure custom user attributes
  • Select another DC for User counting
  • Enable/disable ”Save password with reversible encryption”
• Manage Arbiters
• Download Express list
• Start Express scan
• Update language files
• Update the license (First time add will still require Domain Admin)
• Get a limited view of the Sentinel status on the Password Policy Sentinel state tab (Only if Web API is enabled on a DC, to get correct version status will still require Domain Admin)

Top menu [domain_name]

The top menu, indicated by your domain name, includes the following sections:

• Change domains: switch between available domains.
• Change domain controller: switch between available domain controllers.
• Disable and enable Specops Password Policy: Applied to your entire domain and determines whether the Sentinel processes incoming password changes.
• License: provides an overview of the current license.
• Import license file: allows you to import new licesnses.

Password policies

You can use the Password policies tab to perform the following tasks:

• Create a new Password Policy, or associate an existing policy with a new GPO.
• View the list of all Group Policy Objects in your domain that contain password policy settings.
• Get an overview of the password policy rules associated with each GPO listed.
• Edit an existing policy.
• Remove a policy from a GPO.

Creating a new Password Policy

1. Click Create New Password Policy
2. Select an existing GPO by clicking its name in the Group Policy Object list, or click New Group Policy Object… to create a new GPO to link to this OU and policy.Note that when you create a new GPO, you will get the option to name it, as well as associate it with an existing Organizational Unit. By default the GPO will apply to all users in the group. You can also filter which users the GPO applies to by adding security groups.
3. Click OK.
4. Select a template from the list, or choose Custom if you want to create a policy from scratch, then click Next.
5. Configure the policy, then click OK.

For more information on policy configuration, please refer to the Policy Settings section.

Editing an existing policy

1. Select the GPO whose policy you want to edit in the Password Policy column.
2. Click Edit Policy
3. Edit the policy, then click OK.

For more information on policy configuration, please refer to the Policy Settings section.

Removing a policy from a GPO

1. Select the GPO whose policy you want to remove in the Password Policy column.
2. Click Remove Policy.
3. In the confirmation pop-up, click Yes. The policy will be removed from the list.

Domain Settings

You can use the Domain Settings menu to perform the following tasks:

• Save previous password with reversible encryption: Allows you to save the user’s previous password with reversible encryption in Active Directory.
  Reversible encryption is needed for the following settings:
  • Disallow reusing part of the current password
  • Minimum number of changed characters
    NOTE

    If the checkbox isn’t checked, the password is saved with one way encryption.
• SMTP Settings: Here the global SMTP settings for all email notifications can be configured. The following settings need to be configured:
  NOTE

  It is recommended to configure the SMTP settings in the Domain Administration tool before making any changes to the email templates in the Group Policy snap-in. If the SMTP settings have not been set in the Domain Administration tool, applying changes to the mail templates in the Group Policy snap-in will show a warning informing the administrator that the SMTP settings have to be configured in the Domain Administration tool.
  • The SMTP Server
  • Use TLS (if enabled, communication between the client and the SMTP server are encrypted)
  • Port (port outgoing emails are to be sent through; default is port 25)
  • Authentication (sets the method for authenticating with the SMTP server: Anonymous Access, Basic Authentication, or Integrated Windows Authentication)
  • Default Sender Email Address
  • Default Sender Display Name
  • Admin Notification Email Address

  For more information on all notification settings, please refer to the Notifications page.

• Custom user attributes
  If email and telephone number in Active Directory are not stored in the standard email and mobile fields, respectively, they can be overridden here.

Password Policy Sentinel state

You can use the Password Policy Sentinel state tab to verify that you have installed the Sentinel on all writable domain controllers. If you notice a domain controller is missing the Sentinel component, you can:

• Run the Setup Assistant again to install it, or
• Manually install the Sentinel Component on the affected domain controller

Checking the Sentinel status

Sentinel status can be checked both in the Setup Assistant, as well as in the Domain Administration Tool.

Checking the status in the Domain Administration Tool

1. Click on Password Policy Sentinels.
2. Click on the Domain Controller you want to check.
3. In the table to the right, you can see two statuses: General status (whether the Sentinel is installed and up-to-date on this DC), and Service status (see status messages list below).

Checking the status in the Setup Assistant

1. Click on Domain Controller Sentinel.
2. Right-click on the Sentinel state column for the DC you want to check, and choose Show Details.
3. The pop-up message shows two statuses: General status (whether the Sentinel is installed and up-to-date on this DC), and Service status (see status messages list below).

Sentinel status messages

• Unreachable
• Access Denied
• Unknown error
• Not installed
• Old version
• Newer version installed
• Reboot required
• OK

Sentinel status sorting

In order to make Sentinels that require your attention more identifiable in long lists of Domain Controllers in the table, the list is displayed dynamically. Those sentinels whose status is not OK, will show up at the top of the table. The table sorts on Sentinel status first, then on name.

Enabling and disabling the Sentinel Web API

For information on how to to enable or disable the Sentinel Web API, please refer to the Password Policy Sentinel page.

Password policy templates

You can use the Password policy templates node to create a new password policy template, or view an existing template with NIST, NCSC, Microsoft, and NSA recommendations. A password policy template will help keep your policy settings consistent throughout your domain.

Viewing existing templates

1. Expand the Password policy template menu by clicking the plus icon.
2. Select an existing template in the list to view its settings.

Creating a new Password Policy Template

1. Click New Password Policy Template.
2. In the Template name field, enter a name for the template.
3. In the Description field, enter a description for the template.
4. Specify the settings, and click Save.

Use an existing password policy template

1. In the Group Policy Management Editor expand User Configuration, Policies, Windows Settings node, and select Specops Password Policy.
2. Click Create New Password Policy from Template. Select a Password Policy Template to use for the Group Policy.
3. If the Microsoft or NSA templates are selected, you will be taken to the policy settings page for additional configuration options. If the NIST, and NCSC templates are selected, you will be prompted to:
   1. Create a list of disallowed words.
   2. Download the password dictionary for the template. The dictionary is a combination of password lists designed for penetration tests.
   3. Set a maximum password age for users affected by the policy to proactively check against password dictionaries, and prevent the creation of vulnerable passwords. This is a Specops recommendation that can help you stay protected against the latest dictionary lists.
   4. If the NCSC template is selected, you will be prompted to set a minimum password length for users affected by the policy.
   5. You will be taken to the policy settings page for additional configuration options. Click OK when you are done.

Language files

You can use the Language files tab to update to new versions of language files. This will only update if there are new versions of language files available on the computer where the Domain Administration tool is installed after an upgrade.

Specops Password Auditor

You can use Specops Password Auditor to scan your Active Directory and detect security related weaknesses, specifically related to password policies.

Click Start Specops Password Auditor to get started.

For more information about Specops Password Auditor, click here.

Breached Password Protection

Breached Password Protection Complete

With Specops Breached Password Protection Complete you can make sure that users cannot use passwords that are known to be compromised. In the Domain Administration Tool you can:

• Import API Key
• Test cloud connection
• Unregister
• Register a new Arbiter

Breached Password Protection Express

The Breached Password Express list is a large collection of compromised passwords that you can download in order to prevent users from using any passwords on the list. In the Domain Administration Tool you can:

• Download the latest version of the list

The Group Policy snap-in, installed with the Administration Tools, allows you to create and manage Specops Password Policy settings in Group Policy Objects. The settings are stored as a part of the GPO. Managing Specops Password Policy settings in Group Policy allows you to control how and where the policies are applied.

Create a Specops Password Policy GPO

1. In the GPMC, expand your domain node and locate the Group Policy Object.
2. Right click on the GPO node and select New.
3. Enter a name for the Group Policy Object and click OK.

Applying policy settings

The password policy will apply to all user accounts in locations where your GPO is linked.

If more than one GPO is linked on the same level, the link order of the GPOs determine the order the GPOs will be processed. If conflicting settings from multiple GPO’s apply to a user, Group Policy will resolve the conflict. Group Policy Objects are applied in the following order; The GPO closest to the user object in AD will have the highest precedence:

• Local Group Policy Objects
• Site linked Group Policy Objects
• Domain linked Group Policy Objects
• OU linked Group Policy Objects

If the above order does not enable you to apply your preferred settings, you can use security filtering to control on a permission level which users and computers will be affected by the GPO. Security filtering allows you to apply different policy settings to objects located on the same level in Active Directory.

---

This procedure describes the configuration of an entirely new password policy linked to a newly created GPO.

For creating a policy for an existing GPO, skip to step 7.

For editing existing policies, select the policy in the list, then click Edit, and skip to step 9.

1. In the Domain Adminstration tool, Password Policies click Create new Password Policy.
2. Choose an existing GPO from the list and click OK (skip to step 8), or click New Group Policy object....
3. Give the new GPO a name.
4. Select the OU from the list on the left if the policy should apply only to users in a particular OU.
5. If the policy needs to apply only to users within the selected OU who are also members of a particular security group, click Add in the right column. Enter the name of the security group and click OK. Select the Security group.
6. Click OK.
7. The correct GPO is selected in the list. Click OK.
8. Choose from the list of templates (or choose Custom to start with a blank policy), then click Next.
9. In the Start section, configure the policy to use password rules, passphrases, or both.
10. Configure the General Settings.
11. Configure when passwords are set to expire and what notifications should be sent under Password Expiration.
12. Configure what rules passwords should adhere to (length, required characters, dictionaries etc.) under Password Rules.
13. Click OK.

---

You can create or edit password policies in two ways:

From the Domain Administration Tool

1. Open the Domain Administration Tool
2. In the left navigation, click Password policies
3. Click Create new password policy, or select a GPO in the Password policy list, then click Edit Policy.

From the Group Policy Management Editor

1. Access the Group Policy Management Editor for the GPO you want to associate a policy with
2. Expand User Configuration, Policies, Windows Settings node, and select Specops Password Policy.
3. Click Configure Password Policy, or Create New Password Policy (if the GPO does not yet have a policy associated with it).

Start

You can configure a password policy to use classic password rules, and/or passphrases. A passphrase is a special type of password based on a sentence, or a series of words. The requirements of a passphrase, by default, are that it needs to be long.

General Settings

Password history

Account lockout settings

Password reset options

Client message

This setting is used to control the contents of the message sent to the users when they fail to meet their password rules:

Password expiration

Password expiration notifications (See Also: Notifications

Password Rules

Password length requirements

Character group requirements

Dictionaries

Password content restrictions

Regular expressions

Entropy bar

The entropy bar is shown on the left side of the Password rules tab. It changes according to the settings input in this part of the tool. It is a graphical representation of the relative complexity of the policy in a mathematical sense. The height of the bar corresponds to the combinatorial complexity of the weakest possible password that the policy would accept.

This is not an absolute measure of the policy strength and should mostly be used to compare how different settings in the password rules affect the complexity.

Passphrase

Passphrase requirements

Custom requirements

Breached Password Protection (add-on)

You can enable Breached Password Protection validation during a password reset, and/or password change.

For more information about the Breached Password Protection settings, click here.

---

During a password change from Windows, the user is provided with live feedback about the password policy. The rules set in the policy are displayed on screen, with immediate feedback on which rules the user’s new password complies with, while they are typing it. To provide live feedback about password policy, the Rules UI resolves and reads the password affecting the user.

In order to do this, the Dynamic Feedback UI requires access the network with the computer’s credentials. The computers affected (e.g. through the built-in group “Domain Computers”) should be granted access to:

• read Default Domain Policy (enabled by default)
• When using Specops Password policy: to resolve a user’s SPP policy and read the policy. This is typically enabled by default.
• When using fine-grained password policies (FGPP): to read on the user objects, and to read the FGPP container and the policies in it (CN=Password Settings Container, CN=System, DC=acme, DC=org)
• When using FGPP: to read msDS-PSOApplied and msDS-ResultantPSO on user objects.

---

The Client can be configured using the administrative template in the Group Policy Management Console.

1. Open the GPMC and navigate to the GPO you want to edit.
2. Right click on the GPO and select Edit…
3. In the Group Policy Management Editor dialog box, expand Computer Configuration, Policies, Administrative Templates, and click Specops Authentication Client.
4. Select Specops Password Policy, and double-click the settings you want to configure.
5. Make the desired changes, and click OK.

If you configure the settings, it is recommended to create a Central Store for Group Policy Administrative Templates and add the Specops Password Reset Administrative template.

Create a Central Store for Group Policy Administrative Templates

The Central Store for Administrative Templates allows you to store all template files in a single location on SYSVOL where they can be accessed and presented on any server from your domain. To create a Central Store for Group Policy Administrative Templates, copy the Specops uReset Client ADMX/ADML files from %windir%\PolicyDefinitions.

The ADMX should be copied to:

[your domain]\sysvol\[your domain]\Policies\PolicyDefinitions

The ADML should be copied to:

[your domain]\sysvol\[your domain]\Policies\PolicyDefinitions\en-us

For more information about the Central Store and best practices, visit: www.support.microsoft.com/kb/929841