Password complexity checker

Password complexity checker

If you have enabled in your domain group policy the password complexity (see below), users will probably have some troubles to find the right password that meet these requirements.

The complexity requirements are explained in the “Explain” tab of the policy :

This security setting determines whether passwords must meet complexity requirements.

If this policy is enabled, passwords must meet the following minimum requirements:

Not contain the user’s account name or parts of the user’s full name that exceed two consecutive characters
Be at least six characters in length
Contain characters from three of the following four categories:
English uppercase characters (A through Z)
English lowercase characters (a through z)
Base 10 digits (0 through 9)
Non-alphabetic characters (for example, !, $, #, %)
Complexity requirements are enforced when passwords are changed or created.

For me, the first rule was not clear. I have found a better explanation on this site :

Passwords must not contain the user’s entire samAccountName (Account Name) value or entire displayName (Full Name) value. Both checks are not case sensitive:

The samAccountName is checked in its entirety only to determine whether it is part of the password. If the samAccountName is less than three characters long, this check is skipped.

The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are less than three characters in length are ignored, and substrings of the tokens are not checked. For example, the name “Erin M. Hagens” is split into three tokens: “Erin,” “M,” and “Hagens.” Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either “erin” or “hagens” as a substring anywhere in the password.

I have written the following script to help users to check the password with the requirements described above.

  • The script checks first the samaccountname and the displayname of the user that runs the script using the cmdlet GetAD-User.
  • After that the complexity requirements are checked.
  • Finally, the script gives the reason why the password is valid or not.




Do not hesitate to leave a comment if you have any questions


Leave a Reply

Your email address will not be published. Required fields are marked *