Managing Active Directory (AD) security can be challenging, particularly when identifying accounts sharing passwords or using weak authentication practices. Enter LazyAdminFinder, a powerful, lightweight PowerShell tool that quickly reveals shared password usage and improves your organization's AD security posture. LazyAdminFinder What is LazyAdminFinder? LazyAdminFinder is a PowerShell script leveraging the DSInternals module to: Detect and report shared NTLM password hashes.
Archive and compare historical hash data to identify password reuse.
Provide comprehensive reports that pinpoint risky account behaviors. Detect and report shared NTLM password hashes. Archive and compare historical hash data to identify password reuse. Provide comprehensive reports that pinpoint risky account behaviors. Designed specifically for Active Directory administrators, LazyAdminFinder provides quick, actionable insights into password security. Why Use LazyAdminFinder? Security Improvement: Identify weak or compromised passwords.


Compliance: Maintain AD integrity for audit and compliance purposes.


Efficiency: Quickly audit accounts without manually reviewing data. Security Improvement: Identify weak or compromised passwords. Security Improvement: Identify weak or compromised passwords. Security Improvement: Compliance: Maintain AD integrity for audit and compliance purposes. Compliance: Maintain AD integrity for audit and compliance purposes. Compliance: Efficiency: Quickly audit accounts without manually reviewing data. Efficiency: Quickly audit accounts without manually reviewing data. Efficiency: How Does LazyAdminFinder Work? Fetch and Filter User Accounts The script collects AD user accounts, filtering out disabled, machine, and service accounts to focus only on active users. NTLM Hash Extraction and Archiving LazyAdminFinder extracts NTLM hashes from accounts and securely archives their SHA-256 hashes for historical comparison. Password Reuse Detection By comparing the current run to previous archives, the tool detects password reuse, flagging accounts with potential security risks. This helps identify: Admins or privileged users synchronizing passwords between standard and administrative accounts.
Users, especially admins, repeatedly resetting their passwords to previously used values. Admins or privileged users synchronizing passwords between standard and administrative accounts. Users, especially admins, repeatedly resetting their passwords to previously used values. Shared Password Grouping The script identifies and groups accounts sharing identical NTLM hashes, which can indicate either intentional password sharing or multiple users independently choosing the same password—often due to weak password habits. For example, if several users select a common password like "Summer2025!", LazyAdminFinder will group these accounts together, allowing you to quickly spot both potential shared passwords and risky parallel thinking in password creation. Recommended Frequency of Use Consider running LazyAdminFinder regularly based on your organization's password reset policy. For instance, if your policy mandates a password reset every 90 days, schedule the script to run approximately every 100 days. This timing ensures you capture instances where admins or privileged users might reset their passwords back to previously used ones. If your organization doesn't enforce a password reuse policy, running LazyAdminFinder periodically becomes even more crucial to identify and mitigate potential security risks. Installing LazyAdminFinder Step 1: Preparation Ensure PowerShell is installed on your system.
Install the required module: Ensure PowerShell is installed on your system. Install the required module: Install-Module DSInternals Install-Module DSInternals Step 2: Configure the Script Customize these essential parameters within the provided script: Domain Controller: Domain Controller: Domain Controller: $dc = "your-domain-controller.example.com" $dc = "your-domain-controller.example.com" Naming Context: Naming Context: Naming Context: $nc = "DC=yourdomain,DC=com" $nc = "DC=yourdomain,DC=com" Output Report Path: Output Report Path: Output Report Path: $outputReport = "C:\Path\To\SharedPasswordsReport.csv" $outputReport = "C:\Path\To\SharedPasswordsReport.csv" Archive Directory: Archive Directory: Archive Directory: $archiveDir = "C:\Path\To\HashArchives" $archiveDir = "C:\Path\To\HashArchives" Step 3: Run the Script Execute the script as a Domain admin: powershell.exe -ExecutionPolicy Bypass -File "C:\Path\To\LazyAdminFinder.ps1" powershell.exe -ExecutionPolicy Bypass -File "C:\Path\To\LazyAdminFinder.ps1" Reviewing the Results A detailed CSV report is generated, clearly highlighting accounts sharing passwords or independently choosing weak passwords.
Historical archives are stored securely for future comparisons, ensuring robust password management. A detailed CSV report is generated, clearly highlighting accounts sharing passwords or independently choosing weak passwords. Historical archives are stored securely for future comparisons, ensuring robust password management. Use Cases for LazyAdminFinder Security Audits: Regularly identify and remediate shared, weak, or compromised passwords.
Incident Response: Quickly detect compromised accounts following security incidents.
Routine Compliance Checks: Ensure ongoing compliance by maintaining robust account security practices.
Privileged Account Management: Specifically target administrators or privileged users who may reuse or synchronize passwords across multiple accounts. Security Audits: Regularly identify and remediate shared, weak, or compromised passwords. Security Audits: Incident Response: Quickly detect compromised accounts following security incidents. Incident Response: Routine Compliance Checks: Ensure ongoing compliance by maintaining robust account security practices. Routine Compliance Checks: Privileged Account Management: Specifically target administrators or privileged users who may reuse or synchronize passwords across multiple accounts. Privileged Account Management: Customizing LazyAdminFinder Feel free to adjust the script according to your environment and needs: Modify filtering logic to include/exclude specific account types.
Adjust archival and reporting paths for your storage preferences.
Integrate additional reporting capabilities as required. Modify filtering logic to include/exclude specific account types. Adjust archival and reporting paths for your storage preferences. Integrate additional reporting capabilities as required. Benefits of Using LazyAdminFinder Rapid Security Assessments: Automates complex AD security checks.


Enhanced Visibility: Clearly identifies potential security risks within AD.


Proactive Defense: Enables administrators to swiftly address vulnerabilities before exploitation. Rapid Security Assessments: Automates complex AD security checks. Rapid Security Assessments: Automates complex AD security checks. Rapid Security Assessments: Enhanced Visibility: Clearly identifies potential security risks within AD. Enhanced Visibility: Clearly identifies potential security risks within AD. Enhanced Visibility: Proactive Defense: Enables administrators to swiftly address vulnerabilities before exploitation. Proactive Defense: Enables administrators to swiftly address vulnerabilities before exploitation. Proactive Defense: LazyAdminFinder simplifies the critical task of password auditing in Active Directory, empowering administrators to maintain a secure, compliant, and efficient IT environment. Discover shared passwords, remediate security risks, and fortify your AD security effortlessly with LazyAdminFinder. #Another        /\_[]_/\
#    fine      |] _||_ [|
#       ___     \/ || \/
#      /___\       ||
#     (|0 0|)      ||
#   __/{\U/}\_ ___/vvv
#  / \  {~}   / _|_P|
#  | /\  ~   /_/   []
#  |_| (____)        
#  \_]/______\  Barberion  
#     _\_||_/_     Production      
#    (_,_||_,_)
#
Import-Module DSInternals

# === Parameters ===
$dc           = "your-domain-controller.example.com"
$nc           = "DC=yourdomain,DC=com"
$outputReport = "C:\Path\To\SharedPasswordsReport.csv"
$archiveDir   = "C:\Path\To\HashArchives"

# Ensure archive directory exists
if (-not (Test-Path $archiveDir)) {
    New-Item -ItemType Directory -Path $archiveDir | Out-Null
}

$timestamp = (Get-Date).ToString("yyyyMMdd_HHmmss")

# === 1. Fetch & filter AD user accounts ===
Write-Host "[+] Fetching AD user accounts (skipping machines, service & disabled)..."
$filteredAccounts = Get-ADReplAccount -All -Server $dc -NamingContext $nc |
    Where-Object { $_.NTHash -and $_.SamAccountName } |
    Where-Object { $_.SamAccountName -notmatch '\$$' } |
    Where-Object { $_.SamAccountName -notmatch '^(?i)(svc|service)' } |
    Where-Object {
        if ($_.PSObject.Properties.Match('IsDisabled').Count -gt 0) {
            -not $_.IsDisabled
        }
        else {
            # bit 2 = disabled
            ( ($_.UserAccountControl -band 2) -eq 0 )
        }
    }

if (-not $filteredAccounts) {
    Write-Host "[-] No matching user accounts found. Exiting."
    exit
}

# === 2. Convert NTLM byte array to hex string ===
$filteredAccounts | ForEach-Object {
    $hex = [BitConverter]::ToString($_.NTHash) -replace '-', ''
    $_ | Add-Member -MemberType NoteProperty -Name NTLMHashString -Value $hex -Force
}

# === 3. Archive SHA-256 of each NTLM hash ===
Write-Host "[+] Archiving SHA-256 of each NTLM hash..."
$sha256 = [System.Security.Cryptography.SHA256]::Create()
$currentArchive = $filteredAccounts | ForEach-Object {
    $shaBytes = $sha256.ComputeHash($_.NTHash)
    $shaHex   = [BitConverter]::ToString($shaBytes) -replace '-', ''
    [PSCustomObject]@{
        SamAccountName = $_.SamAccountName
        HashSha256     = $shaHex
    }
}
$sha256.Dispose()

$archiveFile = Join-Path $archiveDir "UserHashArchive_$timestamp.csv"
$currentArchive | Export-Csv -Path $archiveFile -NoTypeInformation

# === 4. Compare to previous archive ===
$allArchives = Get-ChildItem -Path $archiveDir -Filter "UserHashArchive_*.csv" |
               Sort-Object LastWriteTime -Descending

if ($allArchives.Count -gt 1) {
    $previousFile = $allArchives[1].FullName
    Write-Host "[+] Comparing this run to previous archive: $previousFile"
    $prevData = Import-Csv $previousFile

    $reused = Compare-Object `
        -ReferenceObject $prevData `
        -DifferenceObject $currentArchive `
        -Property SamAccountName, HashSha256 `
        -IncludeEqual |
      Where-Object { $_.SideIndicator -eq '==' } |
      Select-Object SamAccountName, HashSha256

    if ($reused) {
        $reuseReport = Join-Path $archiveDir "PasswordReuse_$timestamp.csv"
        Write-Host "[!] $($reused.Count) accounts reused their old hash; exporting to $reuseReport"
        $reused | Export-Csv -Path $reuseReport -NoTypeInformation
    }
    else {
        Write-Host "[+] No password‑reuse detected this run."
    }
}
else {
    Write-Host "[+] Only one archive present; skipping reuse comparison."
}

# === 5. Shared‑password grouping & report ===
Write-Host "[+] Grouping accounts by shared NTLM hash..."
$sharedGroups = $filteredAccounts |
    Group-Object -Property NTLMHashString |
    Where-Object { $_.Count -gt 1 }

if (-not $sharedGroups) {
    Write-Host "[-] No shared hashes found."
    exit
}

$reportResults = @()
Write-Host "[+] Generating shared‑password report:"
foreach ($g in $sharedGroups) {
    $h     = $g.Name
    $users = $g.Group | ForEach-Object { $_.SamAccountName }
    $reportResults += [PSCustomObject]@{
        SharedHash = $h
        UserCount  = $users.Count
        Users      = $users -join ', '
    }

    Write-Host '----------------------------------------------'
    Write-Host "Shared Hash: $h"
    Write-Host "User Count : $($users.Count)"
    Write-Host "Users      : $($users -join ', ')"
    Write-Host '----------------------------------------------`n'
}

Write-Host "[+] Saving shared‑password report to $outputReport"
$reportResults | Export-Csv -Path $outputReport -NoTypeInformation

Write-Host "[Summary] Shared groups: $($reportResults.Count); Total archives: $($allArchives.Count)" #Another        /\_[]_/\
#    fine      |] _||_ [|
#       ___     \/ || \/
#      /___\       ||
#     (|0 0|)      ||
#   __/{\U/}\_ ___/vvv
#  / \  {~}   / _|_P|
#  | /\  ~   /_/   []
#  |_| (____)        
#  \_]/______\  Barberion  
#     _\_||_/_     Production      
#    (_,_||_,_)
#
Import-Module DSInternals

# === Parameters ===
$dc           = "your-domain-controller.example.com"
$nc           = "DC=yourdomain,DC=com"
$outputReport = "C:\Path\To\SharedPasswordsReport.csv"
$archiveDir   = "C:\Path\To\HashArchives"

# Ensure archive directory exists
if (-not (Test-Path $archiveDir)) {
    New-Item -ItemType Directory -Path $archiveDir | Out-Null
}

$timestamp = (Get-Date).ToString("yyyyMMdd_HHmmss")

# === 1. Fetch & filter AD user accounts ===
Write-Host "[+] Fetching AD user accounts (skipping machines, service & disabled)..."
$filteredAccounts = Get-ADReplAccount -All -Server $dc -NamingContext $nc |
    Where-Object { $_.NTHash -and $_.SamAccountName } |
    Where-Object { $_.SamAccountName -notmatch '\$$' } |
    Where-Object { $_.SamAccountName -notmatch '^(?i)(svc|service)' } |
    Where-Object {
        if ($_.PSObject.Properties.Match('IsDisabled').Count -gt 0) {
            -not $_.IsDisabled
        }
        else {
            # bit 2 = disabled
            ( ($_.UserAccountControl -band 2) -eq 0 )
        }
    }

if (-not $filteredAccounts) {
    Write-Host "[-] No matching user accounts found. Exiting."
    exit
}

# === 2. Convert NTLM byte array to hex string ===
$filteredAccounts | ForEach-Object {
    $hex = [BitConverter]::ToString($_.NTHash) -replace '-', ''
    $_ | Add-Member -MemberType NoteProperty -Name NTLMHashString -Value $hex -Force
}

# === 3. Archive SHA-256 of each NTLM hash ===
Write-Host "[+] Archiving SHA-256 of each NTLM hash..."
$sha256 = [System.Security.Cryptography.SHA256]::Create()
$currentArchive = $filteredAccounts | ForEach-Object {
    $shaBytes = $sha256.ComputeHash($_.NTHash)
    $shaHex   = [BitConverter]::ToString($shaBytes) -replace '-', ''
    [PSCustomObject]@{
        SamAccountName = $_.SamAccountName
        HashSha256     = $shaHex
    }
}
$sha256.Dispose()

$archiveFile = Join-Path $archiveDir "UserHashArchive_$timestamp.csv"
$currentArchive | Export-Csv -Path $archiveFile -NoTypeInformation

# === 4. Compare to previous archive ===
$allArchives = Get-ChildItem -Path $archiveDir -Filter "UserHashArchive_*.csv" |
               Sort-Object LastWriteTime -Descending

if ($allArchives.Count -gt 1) {
    $previousFile = $allArchives[1].FullName
    Write-Host "[+] Comparing this run to previous archive: $previousFile"
    $prevData = Import-Csv $previousFile

    $reused = Compare-Object `
        -ReferenceObject $prevData `
        -DifferenceObject $currentArchive `
        -Property SamAccountName, HashSha256 `
        -IncludeEqual |
      Where-Object { $_.SideIndicator -eq '==' } |
      Select-Object SamAccountName, HashSha256

    if ($reused) {
        $reuseReport = Join-Path $archiveDir "PasswordReuse_$timestamp.csv"
        Write-Host "[!] $($reused.Count) accounts reused their old hash; exporting to $reuseReport"
        $reused | Export-Csv -Path $reuseReport -NoTypeInformation
    }
    else {
        Write-Host "[+] No password‑reuse detected this run."
    }
}
else {
    Write-Host "[+] Only one archive present; skipping reuse comparison."
}

# === 5. Shared‑password grouping & report ===
Write-Host "[+] Grouping accounts by shared NTLM hash..."
$sharedGroups = $filteredAccounts |
    Group-Object -Property NTLMHashString |
    Where-Object { $_.Count -gt 1 }

if (-not $sharedGroups) {
    Write-Host "[-] No shared hashes found."
    exit
}

$reportResults = @()
Write-Host "[+] Generating shared‑password report:"
foreach ($g in $sharedGroups) {
    $h     = $g.Name
    $users = $g.Group | ForEach-Object { $_.SamAccountName }
    $reportResults += [PSCustomObject]@{
        SharedHash = $h
        UserCount  = $users.Count
        Users      = $users -join ', '
    }

    Write-Host '----------------------------------------------'
    Write-Host "Shared Hash: $h"
    Write-Host "User Count : $($users.Count)"
    Write-Host "Users      : $($users -join ', ')"
    Write-Host '----------------------------------------------`n'
}

Write-Host "[+] Saving shared‑password report to $outputReport"
$reportResults | Export-Csv -Path $outputReport -NoTypeInformation

Write-Host "[Summary] Shared groups: $($reportResults.Count); Total archives: $($allArchives.Count)"

The code in this story is for educational purposes. The readers are solely responsible for whatever they build with it.

Walkthroughs, tutorials, guides, and tips. This story will teach you how to do something new or how to do something better.

Clearly

Fetch

Routine

BarbaricBoot Is the Mass Reboot Tool Your IT Department Didn’t Know It Needed

WordRaider: The Outlook Macro That Rewrites Your Emails with Barberion Precision

Read My Stories

Too Long; Didn't Read

Download free Tech Leaders Productivity Report!

LazyAdminFinder: Easily Discover Shared Passwords and Enhance Active Directory Security

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Untitled Story

BarbaricBoot Is the Mass Reboot Tool Your IT Department Didn’t Know It Needed

Why Being Likable At Work Matters

Windows Sticky Keys Exploit: The War Veteran That Never Dies

Is ‘bias for action’ making product managers lazier?

Zero People Charged With Online Pirating, Swedish Prosecutor's Office Reports

BarbaricBoot Is the Mass Reboot Tool Your IT Department Didn’t Know It Needed

Why Being Likable At Work Matters

Windows Sticky Keys Exploit: The War Veteran That Never Dies

Is ‘bias for action’ making product managers lazier?

Zero People Charged With Online Pirating, Swedish Prosecutor's Office Reports

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps