Why Password Blacklisting Matters

Even with strong complexity requirements, users frequently choose passwords that include obvious words — your company name, your city, product names, sports teams, or seasonal patterns like "Summer2024!" These passwords satisfy complexity rules but are trivially guessable through targeted dictionary attacks. In nearly every internal penetration test we conduct, password spraying attacks using organization-specific terms are among the first techniques we apply — and among the most successful.

Microsoft Active Directory Password Protection

AD Password Protection has two components: the globally banned password list (maintained by Microsoft, updated automatically) and a custom banned password list that you control. Both are enforced by DC agents installed on your domain controllers, with an Azure AD Password Protection Proxy service for on-premises environments.

What to Include in Your Custom Banned List

  • Your organization's name and common abbreviations
  • Your product or service names
  • Your city, state, and office location names
  • Your domain name and subdomain names
  • Seasonal patterns ("Spring", "Summer", "Winter", "Fall")
  • Current year and near-future years
  • Common industry-specific terms in your sector
  • Names of leadership, buildings, or office locations
  • Previously breached passwords from your own environment

Implementation Steps (On-Premises AD)

  1. In the Azure portal, navigate to Azure Active Directory → Security → Authentication Methods → Password Protection
  2. Enable "Custom banned passwords" and enter your organization-specific terms, one per line
  3. Set Lockout threshold and duration appropriate for your environment
  4. Download and install the Azure AD Password Protection DC Agent on all domain controllers
  5. Install the Azure AD Password Protection Proxy service on domain-joined servers (minimum two for redundancy)
  6. Register the proxy servers with Azure AD using Register-AzureADPasswordProtectionProxy
  7. Register the forest using Register-AzureADPasswordProtectionForest
  8. Set the DC agent to Audit mode initially, review event logs, then switch to Enforcement mode

Weak passwords are among the most exploited findings in our network tests.

Find out whether your password policies are holding up under adversarial testing.

Get a Quote →