Windows Password Security: A Complete Guide

Secure password management is a fundamental aspect of Windows cybersecurity. This guide explores advanced techniques for protecting and managing passwords.

1. Password Policy

Basic Configuration

# Configure the password policy
net accounts /minpwlen:12 /maxpwage:90 /minpwage:1 /uniquepw:24

# Enable complexity
secedit /configure /cfg C:\Windows\Security\templates\secsetup.inf /areas SECURITYPOLICY

# Configure via GPO
gpupdate /force

Advanced Settings

# Detailed configuration
$passwordPolicy = @{
    "MinimumLength" = 12
    "MaximumAge" = 90
    "MinimumAge" = 1
    "ComplexityEnabled" = $true
    "ReversibleEncryptionEnabled" = $false
    "PasswordHistorySize" = 24
}

# Apply the settings
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "RequireSignOrSeal" -Value 1

2. Account Management

Creating Accounts

# Create an account with a complex password
$password = ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force
New-LocalUser -Name "User1" -Password $password -PasswordNeverExpires $false -UserMayNotChangePassword $false

# Configure permissions
$acl = Get-Acl "C:\Users\User1"
$acl.SetAccessRuleProtection($true, $false)
Set-Acl "C:\Users\User1" $acl

Group Management

# Create a security group
New-LocalGroup -Name "SecurityAdmins" -Description "Administrateurs de sécurité"

# Add users to the group
Add-LocalGroupMember -Group "SecurityAdmins" -Member "User1"

# Configure rights
$groupPolicy = @{
    "PasswordComplexity" = 1
    "MinimumLength" = 12
    "MaximumAge" = 90
}

3. Password Protection

Encryption

# Encrypt stored passwords
$password = Read-Host -AsSecureString "Entrez le mot de passe"
$encrypted = ConvertFrom-SecureString $password

# Secure storage
$secureString = ConvertTo-SecureString $encrypted

Strength Verification

# Password strength verification script
function Test-PasswordStrength {
    param (
        [Parameter(Mandatory=$true)]
        [string]$Password
    )
    
    $score = 0
    if ($Password.Length -ge 12) { $score++ }
    if ($Password -match "[A-Z]") { $score++ }
    if ($Password -match "[a-z]") { $score++ }
    if ($Password -match "[0-9]") { $score++ }
    if ($Password -match "[^A-Za-z0-9]") { $score++ }
    
    return $score
}

4. Auditing and Monitoring

Audit Configuration

# Enable password auditing
auditpol /set /category:"Account Logon" /success:enable /failure:enable
auditpol /set /category:"Account Management" /success:enable /failure:enable

# Configure logs
wevtutil sl Security /maxsize:4294967296 /retention:true

Monitoring Login Attempts

# Login attempt monitoring script
function Monitor-LoginAttempts {
    $events = Get-EventLog -LogName Security -InstanceId 4625 -After (Get-Date).AddHours(-1)
    foreach ($event in $events) {
        Write-Host "Tentative échouée: $($event.TimeGenerated) - $($event.Message)"
    }
}

5. Recovery and Reset

Recovery Procedures

# Create a recovery account
$recoveryPassword = ConvertTo-SecureString "Rec0v3ryP@ss" -AsPlainText -Force
New-LocalUser -Name "RecoveryAdmin" -Password $recoveryPassword -Description "Compte de récupération"

# Configure recovery rights
$recoveryGroup = New-LocalGroup -Name "RecoveryOperators"
Add-LocalGroupMember -Group "RecoveryOperators" -Member "RecoveryAdmin"

Secure Reset

# Password reset script
function Reset-PasswordSecurely {
    param (
        [Parameter(Mandatory=$true)]
        [string]$Username
    )
    
    $newPassword = [System.Web.Security.Membership]::GeneratePassword(12, 3)
    $securePassword = ConvertTo-SecureString $newPassword -AsPlainText -Force
    Set-LocalUser -Name $Username -Password $securePassword
    
    # Notify the user
    Send-MailMessage -To "user@example.com" -Subject "Réinitialisation de mot de passe" -Body "Votre nouveau mot de passe est: $newPassword"
}

6. Best Practices

Rotation Policies

# Configure password rotation
$rotationPolicy = @{
    "RotationInterval" = 90
    "NotificationDays" = 7
    "GracePeriod" = 3
}

# Notification script
function Send-PasswordExpirationNotice {
    $users = Get-LocalUser | Where-Object {$_.Enabled -eq $true}
    foreach ($user in $users) {
        $passwordAge = (Get-Date) - $user.PasswordLastSet
        if ($passwordAge.Days -ge ($rotationPolicy.RotationInterval - $rotationPolicy.NotificationDays)) {
            Send-MailMessage -To "$($user.Name)@example.com" -Subject "Expiration de mot de passe" -Body "Votre mot de passe expire dans $($rotationPolicy.RotationInterval - $passwordAge.Days) jours"
        }
    }
}

Handling Exceptions

# Service account management
function Set-ServiceAccountPassword {
    param (
        [Parameter(Mandatory=$true)]
        [string]$ServiceName
    )
    
    $service = Get-Service $ServiceName
    if ($service) {
        $newPassword = [System.Web.Security.Membership]::GeneratePassword(32, 5)
        $securePassword = ConvertTo-SecureString $newPassword -AsPlainText -Force
        
        # Update the service account password
        Set-LocalUser -Name $service.UserName -Password $securePassword
        
        # Restart the service
        Restart-Service $ServiceName
    }
}

7. Tools and Scripts

Security Verification

# Password security verification script
function Test-PasswordSecurity {
    $issues = @()
    
    # Check the policy
    $policy = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters"
    if ($policy.MinimumPasswordLength -lt 12) {
        $issues += "Longueur minimale insuffisante"
    }
    
    # Check the accounts
    $accounts = Get-LocalUser | Where-Object {$_.Enabled -eq $true}
    foreach ($account in $accounts) {
        if ($account.PasswordRequired -eq $false) {
            $issues += "Compte $($account.Name) sans mot de passe requis"
        }
    }
    
    return $issues
}

Automated Maintenance

# Password maintenance script
function Update-PasswordSecurity {
    # Update the policy
    net accounts /minpwlen:12 /maxpwage:90 /minpwage:1 /uniquepw:24
    
    # Check the accounts
    $accounts = Get-LocalUser | Where-Object {$_.Enabled -eq $true}
    foreach ($account in $accounts) {
        if ($account.PasswordRequired -eq $false) {
            Set-LocalUser -Name $account.Name -PasswordRequired $true
        }
    }
    
    # Clean up expired passwords
    $expiredAccounts = Get-LocalUser | Where-Object {$_.PasswordExpires -and $_.PasswordLastSet -lt (Get-Date).AddDays(-90)}
    foreach ($account in $expiredAccounts) {
        Disable-LocalUser -Name $account.Name
    }
}

Conclusion

Windows password security requires:

• A robust password policy
• Strict account management
• Constant monitoring
• Recovery procedures
• Precise documentation

Key takeaways:

• Use complex passwords
• Implement regular rotation
• Monitor login attempts
• Maintain recovery procedures
• Document all actions