All Episodes

May 15, 2025 β€’ 4 mins

πŸŽ™οΈ In this episode, Craig Birch dives into a critical but often overlooked AD misconfiguration: accounts that allow password storage with reversible encryption.
This setting can bypass your domain password policies and expose credentials to plaintext extraction by tools like Mimikatz or DCSync.

πŸ” What You’ll Learn:

β€’ Why reversible password encryption is still found in AD environments
β€’ How it allows attackers to dump plaintext passwords
β€’ How to find accounts with this setting using PowerShell
β€’ Steps to remediate and eliminate this risky configuration
β€’ Why this setting defeats complexity, length, and hashing protections

πŸ› οΈ PowerShell Spotlight:# Find users with reversible encryption enabled

Get-ADUser -Filter {AllowReversiblePasswordEncryption -eq $true} `

-Properties AllowReversiblePasswordEncryption |

Select-Object Name, SamAccountName

# Optional: Remediate the setting

Set-ADUser username -AllowReversiblePasswordEncryption $false

βœ… Use this to eliminate one of the most easily exploitable password risks in AD.

βœ… Quick Takeaways:

  • Reversible encryption = plaintext storage risk

  • Bypasses password complexity and policy protections

  • Vulnerable to Mimikatz, DCSync, and backup extraction

  • Use PowerShell to quickly find and fix weak accounts

  • Audit user provisioning workflows to prevent reintroduction

πŸ’¬ Like what you heard? Give us a thumbs-up, comment, or drop a topic you’d like covered in 10 minutes or less.

πŸ“Œ Powered by Guardians of the Directory

Mark as Played

Advertise With Us

Popular Podcasts

Las Culturistas with Matt Rogers and Bowen Yang

Las Culturistas with Matt Rogers and Bowen Yang

Ding dong! Join your culture consultants, Matt Rogers and Bowen Yang, on an unforgettable journey into the beating heart of CULTURE. Alongside sizzling special guests, they GET INTO the hottest pop-culture moments of the day and the formative cultural experiences that turned them into Culturistas. Produced by the Big Money Players Network and iHeartRadio.

Dateline NBC

Dateline NBC

Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com

24/7 News: The Latest

24/7 News: The Latest

The latest news in 4 minutes updated every hour, every day.

Music, radio and podcasts, all free. Listen online or download the iHeart App.

Connect

Β© 2025 iHeartMedia, Inc.