Geek Answers Handbook

Set Active Directory password hash to SHA1?

I synchronize users from an external system to ours. I need to set a user password in our Active Directory.

I get only SHA1 passwords of external users, and there setPasswordwill be a hash no matter what I enter.

  • Does the user set the unicodePwdactual hash field?
    • If so, can I just set it to the provided hash?
    • If not, how / can I set the hash stored in Active Directory?
+5
source share
3 answers

, unicodePwd . userPasswd, , , Active-Directory.

0

, , , . / AD, :

100% , LDAP , , - .

0

AD . , DC , , MD4, MD5, PBKDF2 (4096 * SHA1) . , (NTLM, Kerberos, Digest,...) -, AD .

AD: unicodePwd, dBCSPwd, lmPwdHistory, ntPwdHistory Credentials. LDAP ADSI. PowerShell, :

Get-ADReplAccount -SamAccountName John -Domain Contoso -Server LON-DC1

MD4 ( AKA NT) ​​ AD SAMR. , , PowerShell.

NT, PowerShell:

$hash = ConvertTo-NTHash (Read-Host -AsSecureString)

, , NT AD:

Set-SamAccountPasswordHash -SamAccountName john -Domain ADATUM -NTHash $hash -Server dc1.adatum.com

These commands can be used to transfer passwords between local and domain accounts or between AD and Samba. But be careful, Kerberos-AES and WDigest authentication will not work with this account, only NTLM and Kerberos-RC4.

0
source

More articles:


All Articles