IT audit examines password details to ensure security and compliance.
IT audit examines password details to ensure security and compliance.
Recently, our company’s IT department started checking passwords and marking any with personal details as risky. I understand why my password fails—they’re not using hashing properly, which means plaintext could be exposed. I’m frustrated that they can read passwords directly instead of protecting them. Is Active Directory really storing hashed values? Could a specific algorithm reveal parts of the original string during comparison? Or are they storing plaintext somewhere and pretending it’s secure? 1 = My only guess is that the hash actually contains fragments of the password, but I don’t have proof of this.
They probably just tweak password rules and push for a change across all accounts. If they’re known for poor handling, it might be an attempt to exaggerate their security skills. The person I replaced often manipulated staff to meet strict, harsh password policies. I don’t know of any method to view passwords directly in Microsoft AD, but I’m interested to find out.
They don't need to keep passwords in plain text; they can process it whenever you type it for compliance. In a few uncommon situations, the password is checked during creation and details are saved in clear text, such as showing: amount of letters, numbers, no special symbols, etc.
Auditing passwords is a fresh topic for me. Throughout my six years in IT, I've never seen a manager say something so absurd. If someone hasn't updated their password since the new policy was introduced, it's likely they're trying to uncover it—best to go with what they suggest to avoid any blame later.
This approach follows the standard method used by most websites. Your browser performs local verification.
This section has been consistent since last June, but it wasn’t highlighted then. After the fact, it appears they’re viewing it in plaintext. I sent a follow-up email to check if anyone would contact me about it—I’m not sure they’ll respond.
Absolutely, you had to enter it since last June. Each time you do, it gets encrypted and sent to the server, where it’s decrypted and verified so you can log in. The server can review it anytime and alert IT if there’s an issue, or it might automatically block you until you fix it. This process is standard and widely used.