Password-Not-Required attribute is true. Does this mean that the user can log on withour password?

Question

Hi,

I've noted that there are user accounts in Active Directory with Password-Not-Required (https://learn.microsoft.com/en-us/windows/win32/adschema/a-useraccountcontrol) value equals to "true". Does this mean that the user can log on without a password? Does this override Group Policy for account logons?

Thank you,

Kervin

Answer 1

Hi @KervinPaulRVinluan-0523 ,

Yes, this can override group policy and make it so that your accounts do not have passwords required. This can cause a security gap, but you can easily fix it by querying for the accounts that have "Password-Not-Required" = true and switching the setting to false.

First, you can get the list of all user accounts that do not require a password:

 Get-ADUser -Filter {PasswordNotRequired -eq $true}

Then you can correct the accounts using:

 Get-ADUser -Identity User2 | Set-ADUser -PasswordNotRequired $false

https://learn.microsoft.com/en-us/powershell/module/addsadministration/set-aduser?view=win10-ps