DSInternals VS ad-password-protection

Thirdly dsinternals suite can be used to resurrect domain controllers from the dead.. it works very well and is pretty easy - https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/New-ADDBRestoreFromMediaScript.md - the person who created this is nothing short of a wizard.

Greetings. I would like to get recommendations for tools that will allow me to audit the password strength of users in Windows Active Directory and Google Workspace. I came across this one for AD that I plan to try. https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Test-PasswordQuality.md

As you have no AD specific backup or recovery plan nor do you have an idea of when ransomware was copied into the environment I.e. how long was it sitting dormant? I’d suggest you take the backup you have then use this script from DSInternals - https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/New-ADDBRestoreFromMediaScript.md - to restore ONLY Active Directory (NTDS + SYSVOl) into clean media (needs to be the same major OS version).

Note**:** The same can be done using the DSInternals Set-SamAccountPasswordHash command.

To find out, you can use the DSInternals command Test-PasswordQuality. It will extract the password hashes for all your user accounts and compare them against the password hashes for a dictionary of weak passwords.

Recovery is still an option with this module: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/New-ADDBRestoreFromMediaScript.md

Load DSInternals Powershell Module (Install-Module DSInternals -Force OR https://github.com/MichaelGrafnetter/DSInternals

FYI, there's a PS module you can use to check passwords. Here's a link to some info about that: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADReplAccount.md

I would like to enforce my active directory policy by adding a password filter. I had already found the solution Lithnet Password filter on Github (https://github.com/lithnet/ad-password-protection). This solution is really great but unfortunately, it applies to all users and not to a specific group. Do you know another solution with more granularity?

Luckily there are a few open source options you can use, eg: https://github.com/lithnet/ad-password-protection

Not currently an adfs user, but at first glance blocking them at creation seems better to me... https://github.com/lithnet/ad-password-protection

You might want to look at Lithnet Password Policies it sounds similar to some of the AzureAD password options but it allows for tiered length and complexity as well.

For local AD: https://github.com/lithnet/ad-password-protection