PW-013HygieneKerberos, passwords and credentials

Accounts that may have an empty password

Accounts with the PASSWD_NOTREQD flag are exempt from the password policy and may have no password at all.

Category: Hygiene
Severity: High in Tier Zero, else Low.
Typical owner: AD / identity team
Data needed: Any collection: the flag is in each account's userAccountControl.

Most useful toDefensive engineers Identity and access engineers Auditors

On this page

In plain language

A flag on an account can tell Active Directory that the account doesn't need a password, whatever the password policy says. It is usually left behind by old provisioning tools. The account may still have a perfectly good password, or it may have none.

Any domain user can list these accounts, and trying an empty password is trivial. Clearing the flag and resetting the password closes the question for good.

What Pathwarden flags

These enabled accounts have the PASSWD_NOTREQD flag (userAccountControl 0x20) set. With this flag, the account is exempt from the domain password policy and may have an empty password. The flag is often left behind by old provisioning tools or scripted account creation.

How attackers use it

Attackers enumerate accounts with this flag (any domain user can read userAccountControl) and try a blank password against each one. A hit gives a working domain account with no cracking needed (Valid Accounts: Domain Accounts, MITRE ATT&CK T1078.002). If any of these accounts is privileged, the finding is rated higher because it is a direct route to Tier Zero.

Find it with Pathwarden

Data needed: Any collection: the flag is in each account's userAccountControl.

In the web UI or the HTML report, open the Findings tab and expand PW-013: each finding shows who can use it (its exposure), the attack path drawn out, the affected objects, and the fix. The remediation path tells you whether a single plan step closes it. On the command line:

Shell

# every finding of this rule, with its path and fix
pathwarden findings -i .\collect --rule PW-013
# the step-by-step guide on this page, offline
pathwarden guide PW-013
# after the fix: collect again, then check it is gone
pathwarden retest -i .\collect-after --rule PW-013

Exit codes make retest easy to script: 0 Fixed, 1 Still open, 3 Can't tell. See findings lifecycle and retest.

Before you change anything

Find out which tool created the accounts. Some provisioning systems set the flag again on their next sync. Fix the tool's template as well.
Clearing the flag does not change the current password. If the password is actually empty, the account keeps working with an empty password until you reset it.
For service accounts, find where the password is configured before resetting it (see PW-010).

How to fix it

Option A: Clear the flag and reset the password (recommended)

Clear the flag with PowerShell (below). Active Directory Users and Computers does not show this flag; to do it in the GUI, use the Attribute Editor tab and remove 0x20 from userAccountControl.
In Active Directory Users and Computers, right-click the account > Reset Password and set a strong password.
For service accounts, update the password wherever it is configured and restart the services.

Option B: Disable unused accounts

If an account in the list is not needed, disable it instead (Disable-ADAccount).

PowerShell

Import-Module ActiveDirectory

# List enabled accounts with PASSWD_NOTREQD (0x20)
Get-ADUser -LDAPFilter "(&(userAccountControl:1.2.840.113556.1.4.803:=32)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" |
    Select-Object SamAccountName

# Clear the flag
Set-ADAccountControl -Identity "<Account>" -PasswordNotRequired $false

# Reset the password so it meets policy (prompts without echoing)
Set-ADAccountPassword -Identity "<Account>" -Reset -NewPassword (Read-Host -AsSecureString "New password")

Verify the fix

PowerShell

Get-ADUser -Identity "<Account>" -Properties PasswordNotRequired |
    Select-Object SamAccountName, PasswordNotRequired

PasswordNotRequired should be False. Collect again (or use Retest on the finding) and confirm the finding ID is gone (or lists fewer accounts).

Roll back

Set-ADAccountControl -Identity "<Account>" -PasswordNotRequired $true restores the flag. This is rarely needed: an account with a valid password works the same with or without the flag.

References

Microsoft: Use the UserAccountControl flagslearn.microsoft.com
MITRE ATT&CK T1078.002: Valid Accounts: Domain Accountsattack.mitre.org