Ukulawula ukhuseleko ye-Active Directory (AD) kunokwenzeka, ikakhulukazi xa kuthetha i-akhawunti ezahlukahlukeneyo okanye usebenzisa iinkqubo ze-authentication ezincinane. , isixhobo eshushu, elula le-PowerShell evumela ngokukhawuleza ukusetyenziswa kwe-password yahlukahlukeneyo kunye nokuphucula ukhuseleko lwe-AD yeenkampani yakho. LazyAdminFinder Yintoni i-LazyAdminFinder? LazyAdminFinder yinkqubo ye-PowerShell esebenzisa i-DSInternals module ukuze: 
 
 
 
 Ukucinga kunye nokuthumela i-shared NTLM password hashes. Izixhobo kunye nokubala iinkcukacha ze-hash ephawulwe ukucacisa ukusetyenziswa kwe-password. Ukunikezela iingcebiso ezininzi ezibonisa iingcebiso ze-akhawunti ezinzima. I-LazyAdminFinder yenzelwe ngokucacileyo kubasebenzisi be-Active Directory, inikeza iinkcukacha zokusebenza ngokukhawuleza kunye ne-password security. Yintoni usebenzisa LazyAdminFinder? 
 
 
 
 
 
  Identify weak or compromised passwords. Security Improvement: 
 
  Maintain AD integrity for audit and compliance purposes. Compliance: 
 
  Quickly audit accounts without manually reviewing data. Efficiency: Indlela LazyAdminFinder ukusebenza? I-Fetch kunye ne-Filter ye-Accounts ye-User I-script ibandakanya i-ad user accounts, ukufilitha i-disabled, i-machine, kunye ne-service accounts ukuze kuxhomekeke kuphela kubasebenzisi abasebenzayo. I-NTLM ye-hash extraction kunye ne-archiving I-LazyAdminFinder ihamba i-hashes ye-NTLM kwi-accounts kunye ne-archives ye-SHA-256 ze-hashes ze-historical. Ukucaciswa kwe-Password Reuse Ukubala isebenze ngokuzenzakalelayo kwi-archives ezidlulileyo, i-tool ibonise ukusetyenziswa kwe-password, ukucacisa i-accounts enezimo zokhuseleko. Oku kunceda ukucacisa: 
 
 
 I-Admins okanye i-Users ze-Privileged zihlanganisa i-passwords phakathi kweakhawunti ze-Standard kunye ne-Administrative. Abasebenzisi, ikakhulukazi abasebenzisi, ukuguqulwa kwakhona iingcango zabo kwiiyure ezidlulileyo ezisetyenziswa. Iimpawu ze-Password Grouping I-script ibonelela kunye nokuhlanganisa i-accounts ezahlukahlukeneyo ezahlukahlukeneyo ze-NTLM, oku kunokuthi ibonise ukuba i-password ezahlukahlukeneyo okanye abasebenzisi ezininzi zihlanganisa i-password efanayo ngokufanayo-ngaphezulu ngenxa yeengxaki ze-password. Umzekelo, ukuba abasebenzisi ezininzi zihlanganisa i-password efanayo njenge-"Summer2025!", i-LazyAdminFinder yahlanganisa i-accounts ezahlukahlukeneyo, okuvumela ukufumana ngokushesha i-password ezahlukahlukeneyo kunye ne-parallel-think efanelekileyo kwi-password creation. Ukusetyenziswa kwama-frequency Ukukhangela ukuqhuba i-LazyAdminFinder ngokuvamile ngokuvumelana nenkqubo yokuguqulwa kwe-password yayo. Umzekelo, ukuba inkqubo yakho inikezela ukuqhuba i-password ngokuvumelana ne-90 iintsuku, uqhagamshelane i-script ukuqhuba ngokuvumelana ngexesha le-100 iintsuku. Le nqakraza ibonelela ukuba ufake iziphumo apho abasebenzisi abavumileyo okanye abasebenzisi abavumelanayo bakwazi ukuqhuba i-passwords zabo kwizithuba ezidlulileyo. Ukuba inkampani yakho ayinxalenye nenkqubo yokuguqulwa kwe-password, ukuqhuba i-LazyAdminFinder ngokuvumelana kwakhona kubaluleke kakhulu ukucacisa kunye nokunciphisa iingxaki zokhuseleko Ukufaka LazyAdminFinder Isinyathelo 1: Ukuhambisa 
 
 
 Ensure PowerShell is installed on your system. Ukufaka i-module efunekayo: Install-Module DSInternals
 Isinyathelo 2: Yenza i-script Qhagamshelana nezi iiparamitha ezincinane kwi-script efunyenweyo: 
 
 Umlawuli weDomain: $dc = "your-domain-controller.example.com"
 
 
 Ukubonisa umzekelo: $nc = "DC=yourdomain,DC=com"
 
 
 Ukuhlolwa kwe-Output Report: $outputReport = "C:\Path\To\SharedPasswordsReport.csv"
 
 
 Isixhobo Archive: $archiveDir = "C:\Path\To\HashArchives"
 Isinyathelo 3: Run the Script Yenza i-script njenge-Domain admin: powershell.exe -ExecutionPolicy Bypass -File "C:\Path\To\LazyAdminFinder.ps1"
 Ukubuyekeza imiphumela 
 
 
 I-CSV epheleleyo ifumaneke, ebonisa ngokucacileyo i-accounts ezahlukahlukeneyo okanye ukhethe i-passwords ezincinane ngokuhambelana. I-archives ye-history ifakwe ngokhuseleko ukusabela kwiminyaka elandelayo, evumela ukulawula i-password enamandla. Ukusetyenziswa kwe-Case for LazyAdminFinder 
 
 
 
 
 I-Security Audits: Uyakwazi ukucacisa kunye nokuguqula i-password ezahlukahlukeneyo, ezincinane, okanye ezincinane. Ukusabela i-incident: Ukukhangela ngokushesha i-accounts eyenziwe emva kweengxaki ze-security. I-Routine Compliance Checks: Qinisekisa ukuxhaswa okuqhubekayo ngokufanelekisa iinkonzo zokhuseleko ze-akhawunti. Ukulawula i-akhawunti ye-Privileged: Izixhobo ezizodwa ze-administrators okanye abasebenzisi be-privileged abakwazi ukuyisebenzisa okanye ukuxhaswa i-passwords kwi-akhawunti ezininzi. Ukucaciswa LazyAdminFinder Fumana ngokugqithisileyo ukuguqulwa kwe-script ngokuxhomekeke kwimeko yakho kunye nezidingo zakho: 
 
 
 
 Ukuguqulwa kwe-logic ye-filtering ukuze kuquka / ukunciphisa iintlobo ze-akhawunti ezithile. Ukulungiselela iindlela ze-archive kunye ne-reporting ngokufanelekileyo kwi-storage preferences yakho. Zifumaneka iinkcukacha zophando ezongezelelweyo njengoko kufuneka. Ukusebenzisa LazyAdminFinder 
 
 
 
 
 
  Automates complex AD security checks. Rapid Security Assessments: 
 
  Clearly identifies potential security risks within AD. Enhanced Visibility: 
 
  Enables administrators to swiftly address vulnerabilities before exploitation. Proactive Defense: I-LazyAdminFinder inikezela isicelo esisiseko se-Password Auditing kwi-Active Directory, okuvumela abasebenzisi abasebenzisi ukuba zithembise kwimeko ye-IT efanelekileyo, efanelekileyo kwaye efanelekileyo. Fumana iingcango ezahlukahlukeneyo, ukuguqula iingcango zokhuseleko, kunye nokukhuthaza ukhuseleko yakho ye-AD ngokushesha kunye ne-LazyAdminFinder. #Another        /\_[]_/\
#    fine      |] _||_ [|
#       ___     \/ || \/
#      /___\       ||
#     (|0 0|)      ||
#   __/{\U/}\_ ___/vvv
#  / \  {~}   / _|_P|
#  | /\  ~   /_/   []
#  |_| (____)        
#  \_]/______\  Barberion  
#     _\_||_/_     Production      
#    (_,_||_,_)
#
Import-Module DSInternals

# === Parameters ===
$dc           = "your-domain-controller.example.com"
$nc           = "DC=yourdomain,DC=com"
$outputReport = "C:\Path\To\SharedPasswordsReport.csv"
$archiveDir   = "C:\Path\To\HashArchives"

# Ensure archive directory exists
if (-not (Test-Path $archiveDir)) {
    New-Item -ItemType Directory -Path $archiveDir | Out-Null
}

$timestamp = (Get-Date).ToString("yyyyMMdd_HHmmss")

# === 1. Fetch & filter AD user accounts ===
Write-Host "[+] Fetching AD user accounts (skipping machines, service & disabled)..."
$filteredAccounts = Get-ADReplAccount -All -Server $dc -NamingContext $nc |
    Where-Object { $_.NTHash -and $_.SamAccountName } |
    Where-Object { $_.SamAccountName -notmatch '\$$' } |
    Where-Object { $_.SamAccountName -notmatch '^(?i)(svc|service)' } |
    Where-Object {
        if ($_.PSObject.Properties.Match('IsDisabled').Count -gt 0) {
            -not $_.IsDisabled
        }
        else {
            # bit 2 = disabled
            ( ($_.UserAccountControl -band 2) -eq 0 )
        }
    }

if (-not $filteredAccounts) {
    Write-Host "[-] No matching user accounts found. Exiting."
    exit
}

# === 2. Convert NTLM byte array to hex string ===
$filteredAccounts | ForEach-Object {
    $hex = [BitConverter]::ToString($_.NTHash) -replace '-', ''
    $_ | Add-Member -MemberType NoteProperty -Name NTLMHashString -Value $hex -Force
}

# === 3. Archive SHA-256 of each NTLM hash ===
Write-Host "[+] Archiving SHA-256 of each NTLM hash..."
$sha256 = [System.Security.Cryptography.SHA256]::Create()
$currentArchive = $filteredAccounts | ForEach-Object {
    $shaBytes = $sha256.ComputeHash($_.NTHash)
    $shaHex   = [BitConverter]::ToString($shaBytes) -replace '-', ''
    [PSCustomObject]@{
        SamAccountName = $_.SamAccountName
        HashSha256     = $shaHex
    }
}
$sha256.Dispose()

$archiveFile = Join-Path $archiveDir "UserHashArchive_$timestamp.csv"
$currentArchive | Export-Csv -Path $archiveFile -NoTypeInformation

# === 4. Compare to previous archive ===
$allArchives = Get-ChildItem -Path $archiveDir -Filter "UserHashArchive_*.csv" |
               Sort-Object LastWriteTime -Descending

if ($allArchives.Count -gt 1) {
    $previousFile = $allArchives[1].FullName
    Write-Host "[+] Comparing this run to previous archive: $previousFile"
    $prevData = Import-Csv $previousFile

    $reused = Compare-Object `
        -ReferenceObject $prevData `
        -DifferenceObject $currentArchive `
        -Property SamAccountName, HashSha256 `
        -IncludeEqual |
      Where-Object { $_.SideIndicator -eq '==' } |
      Select-Object SamAccountName, HashSha256

    if ($reused) {
        $reuseReport = Join-Path $archiveDir "PasswordReuse_$timestamp.csv"
        Write-Host "[!] $($reused.Count) accounts reused their old hash; exporting to $reuseReport"
        $reused | Export-Csv -Path $reuseReport -NoTypeInformation
    }
    else {
        Write-Host "[+] No password‑reuse detected this run."
    }
}
else {
    Write-Host "[+] Only one archive present; skipping reuse comparison."
}

# === 5. Shared‑password grouping & report ===
Write-Host "[+] Grouping accounts by shared NTLM hash..."
$sharedGroups = $filteredAccounts |
    Group-Object -Property NTLMHashString |
    Where-Object { $_.Count -gt 1 }

if (-not $sharedGroups) {
    Write-Host "[-] No shared hashes found."
    exit
}

$reportResults = @()
Write-Host "[+] Generating shared‑password report:"
foreach ($g in $sharedGroups) {
    $h     = $g.Name
    $users = $g.Group | ForEach-Object { $_.SamAccountName }
    $reportResults += [PSCustomObject]@{
        SharedHash = $h
        UserCount  = $users.Count
        Users      = $users -join ', '
    }

    Write-Host '----------------------------------------------'
    Write-Host "Shared Hash: $h"
    Write-Host "User Count : $($users.Count)"
    Write-Host "Users      : $($users -join ', ')"
    Write-Host '----------------------------------------------`n'
}

Write-Host "[+] Saving shared‑password report to $outputReport"
$reportResults | Export-Csv -Path $outputReport -NoTypeInformation

Write-Host "[Summary] Shared groups: $($reportResults.Count); Total archives: $($allArchives.Count)"


The code in this story is for educational purposes. The readers are solely responsible for whatever they build with it.

Walkthroughs, tutorials, guides, and tips. This story will teach you how to do something new or how to do something better.

Read My Stories

Le audio iveliswe ngolwimi lokuqala lwebali!

Inde kakhulu; Ukufunda

Download free Tech Leaders Productivity Report!

LazyAdminFinder: Fumana ngokulula iingxowa ezahlukahlukeneyo kunye nokukhuthaza ukhuseleko ye-Active Directory

About Author

IZIMVO

ZIJONGE IIMPAWU

ELI NQAKU LINIKEZELWE KU

Related Stories

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps