Password Policy Discovery

In Active Directory Domain Services (AD DS), query password-policy settings such as complexity, length, history, age, and lockout thresholds. The domain default and fine-grained password policies (PSOs) are distinct; a domain-wide policy listing does not show which PSO applies to each user. For a named user, query the resultant fine-grained policy when one applies. These settings can inform password guessing or spraying, but policy values alone do not establish that an account is vulnerable.