Lesson 3.3: Password spraying and the lockout policy
Password spraying tries one common password against many accounts, slowly enough to avoid locking any of them out. On a domain it shows up as Kerberos pre-authentication failures (4771) for many users from one source, and the moment it works, as a successful logon from that same source. In the lab you find that Northwind's domain has no account lockout at all, detect last night's spray of forty accounts, see that one password worked and was used straight away, and read the Group Policy setting that has to change.
17 min
You will learn to
- Explain password spraying
- Read the domain password and lockout policy
- Detect spraying in 4771 events
- Find a successful logon after a spray
- Locate the lockout setting in Group Policy
Key terms
- Password spraying
- One or a few common passwords tried against many accounts.
- Account lockout threshold
- Number of failed logons after which an account is locked for a period.
- Default Domain Policy
- The GPO that sets the domain's password, lockout and Kerberos policy.
- SYSVOL
- The share on every DC holding Group Policy files and logon scripts, readable by all domain users.
- Banned password list
- A check that rejects common and company-specific passwords when they're set.
← Storing and checking passwords · All lessons · Sigma rules →