6.3.1 Interpret password policy before credential validation
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A domain query context. The goal is to understand validation risk and identify applicable policy, not begin password spraying.
Where to look: Read domain password and lockout policy, then account-specific restrictions and any applicable fine-grained policy. Keep known prior failures and the selected protocol in view.
Expected behavior / secure boundary: A threshold is only one part of lockout behavior. Duration, observation window, fine-grained policies, existing failures and other systems using the account matter. A displayed zero threshold is not blanket permission for unrestricted guessing.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.3.1.1 Baseline policy using native Windows commands
Run: Windows. Requires: Usable domain query context. Effect: Reads a domain-policy view; not every account-effective policy.
net accounts /domain
6.3.1.2 Determine password policy before testing credentials Policy enumeration using PowerView
Run: Windows PowerShell with reviewed PowerView. Requires: Loaded module and permitted domain policy reads. Effect: Reads policy data; no password guessing.
Get-DomainPolicyData | Select-Object -ExpandProperty SystemAccess
What this checks: net accounts provides a domain-policy view. PowerView exposes related fields, but neither output by itself establishes the effective policy for every user or a safe guessing budget.
6.3.1.3 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
Lockout threshold: 5
Lockout duration: 30 minutes
Lockout observation window: 30 minutes
Known prior failures for selected account: unknown
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| Threshold 5 | A displayed lockout setting. | Do not translate it into five available attempts. | §6.3.1.1 — Interpret password policy before credential validation |
| Prior failures unknown | The account may already be close to lockout. | Avoid guessing; prefer supported evidence/offline analysis. | §6.3.2.1 — Classify recovered credentials and their scope |
| Correct password but denied logon | Credential validity and logon authorization differ. | Check identity scope, logon type and restrictions. | §6.5.1.1 — Diagnose the failed boundary |
Stop when: Applicable policy limitations and unknown prior account state are recorded.
Revisit only when: Account-specific policy or lockout state changes; do not infer a guessing budget.
6.3.1.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | A justified credential needs validation: perform the scoped supported check and record its protocol/context. | §6.4.1.1 — Select a compatible remote-access mechanism |
| Ruled out in this context | Lockout/rate-limit evidence appears: stop that testing path. | §6.3.1.1 — Interpret password policy before credential validation |
| Inconclusive / failed check | Effective policy or prior state is unknown: do not invent a safe spray rate. | §6.3.1.1 — Interpret password policy before credential validation |
6.3.1.5 Tooling and complete procedure
Native net.exe is sufficient for the baseline; PowerView/RSAT adds policy context where installed. No spray tool is needed for this investigation page. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.