Topic starter
24/06/2026 7:15 pm
TL;DR: Weak, reused and compromised passwords can still be accepted in Active Directory when policy is not enforced at creation time, according to Netwrix. AD needs quality gates across the credential lifecycle, or written rules stay detached from actual access control.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “You still have passwords. Now enforce them.”.
Key questions
A: Security teams should start by mapping where weak, reused, or unsecured passwords still exist across apps, browsers, shadow IT tools, and unmanaged AI platforms.
Q: What signals show that password enforcement is actually working?
A: Working enforcement shows up as high rejection rates for weak or reused passwords, fewer user workarounds, and fewer accepted passwords that later match exposed patterns.
Q: Why do password policies fail if they are not enforced at creation time?
A: Because policy describes acceptable behaviour, but enforcement determines whether bad credentials are actually rejected.
Practitioner guidance
- Enforce password checks at creation time Block weak, common, and compromised passwords before they are accepted, rather than relying on users to self-correct after a policy warning.
- Prevent password reuse and near-reuse Reject slight variations of old passwords so users cannot bypass complexity rules with predictable substitutions like appended numbers or symbols.
- Use breach and dictionary screening Compare candidate passwords against breach databases and local dictionaries to stop known weak patterns from entering the environment.
Bottom line: Password policy alone does not prevent weak credentials from entering or surviving in Active Directory environments.
Glossary terms: Password Compliance, Credential Lifecycle, Password reuse, Breach Data Screening
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 21 hours ago by NHI Mgmt Group
25/06/2026 4:27 am
Password policy without enforcement is a governance artefact, not a control. Organisations often confuse the existence of complexity rules with actual credential protection. In practice, weak and compromised passwords continue to exist because the policy does not govern what gets accepted at creation time or how reuse is handled later. The practitioner conclusion is simple: if the control does not block bad credentials, it is only documentation.
A few things that frame the scale:
- According to Forrester Research, a single password reset can cost around $70.
A question worth separating out:
Q: What is the difference between password policy and password enforcement?
A: Password policy defines the rule set, such as length, complexity, and rotation. Password enforcement applies those rules at the point of creation and reuse so that weak or compromised passwords cannot be accepted. One states the standard, the other makes the standard operational.
👉 Read our full editorial: Password policy enforcement is the real control gap in AD