EIDSCA.PR02 - Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.
Overview
If set to Yes, password protection is turned on for Active Directory domain controllers when the appropriate agent is installed.
Azure identity management and access control best practices - Microsoft Learn
Test script
https://graph.microsoft.com/beta/settings
.values -eq 'True'
Related links
- Open in Graph Explorer
- directorySetting resource type - Microsoft Graph beta | Microsoft Learn
- View in Microsoft Entra admin center
MITRE ATT&CK
| Tactic | Technique | Mitigation |
|---|---|---|
| TA0006 - Credential Access - Credential Access | T1110 - Brute Force | M1018 - User Account Management M1027 - Password Policies |
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.PR02 |
| Severity | High |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Related products | Active Directory |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110 Brute Force |
| Supports controls | nist-800-53-r5:IA-5(1) |
| PowerShell test | Test-MtCheckEidscaPR02 |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/eidsca/Test.EIDSCA.PR02.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.PR02.md