Search for AD Accounts with the Password Not Required Attribute Enabled

2.8K

The existence of user accounts with blank/weak passwords can create a significant security risk in AD. Active Directory password policies enforce a minimum password length and password complexity requirements. The default Minimum password length value in the Default Domain Policy is 7 characters, but this is a default value, not a recommended enterprise baseline. You can config a higher minimum, such as 14 or more characters, according to your organization’s security requirements. A Fine-Grained Password Policy (PSO) can define a different effective password policy for specific users/groups.

The PASSWD_NOTREQD flag changes this behavior for an individual account: it indicates that the normal password-length requirement does not apply to that account. However, the flag does not mean that the account currently has a blank password.

Environment. The examples below use the Microsoft ActiveDirectory PowerShell module. On Windows 11, you need to install the Active Directory RSAT tools before running the commands. You can do this with the command below:

Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

On Windows Server, you can install the Active Directory PowerShell module with the following command:

Install-WindowsFeature RSAT-AD-PowerShell

You can verify that the capability is installed with the following command:

# Windows 11
Get-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

# Windows Server
Get-WindowsFeature RSAT-AD-PowerShell

Our examples apply to supported Windows Server versions (including Windows Server 2025) and to supported Windows 11 systems with the RSAT Active Directory tools installed.

The ActiveDirectory module is a Windows PowerShell module. In case you run the commands from PowerShell 7, PowerShell can load the module through its Windows PowerShell compatibility layer. For example:

Import-Module ActiveDirectory -UseWindowsPowerShell

On PowerShell 5.1, you can import the module normally:

Import-Module ActiveDirectory

What is PASSWD_NOTREQD?

PASSWD_NOTREQD is one of the userAccountControl attribute flags. The flag is stored in the userAccountControl attribute as the PASSWD_NOTREQD bit (0x0020, decimal 32). On current versions of Active Directory Users and Computers (ADUC), there is no separate Password not required checkbox in the user’s Account tab. You can inspect the underlying userAccountControl value with Attribute Editor/manage the flag with PowerShell.

Security impact. Note that accounts with PASSWD_NOTREQD enabled represent a high-risk authentication config and you should treat it as a security misconfig in enterprise AD environments.

Using PasswordNotRequired

Check that the PasswordNotRequired option is enabled for the user:

Get-ADUser -Identity i.maier -Properties PasswordNotRequired |
    Select-Object SamAccountName, PasswordNotRequired

Run the following command to set this flag for a user:

Warning. Enabling PasswordNotRequired weakens the normal password requirements for the account. You should use the following command only in a test/lab environment or when you have a documented admin reason to enable this setting. Do not enable PASSWD_NOTREQD on production accounts as a troubleshooting step.

Set-ADUser -Identity i.maier -PasswordNotRequired $true

Also, you can set this flag by changing the userAccountControl value from 512 (NORMAL_ACCOUNT) to 544 = NORMAL_ACCOUNT (512) + PASSWD_NOTREQD (32). See the post explaining the userAccountControl attribute.

Password policy behavior with PASSWD_NOTREQD

PASSWD_NOTREQD changes how the minimum-password-length requirement is evaluated for that account. The result also depends on whether the password operation is a user-initiated password change or an administrative password reset/set operation. Depending on the effective password policy and the password operation being performed, Windows may reject an empty password with a Password does not meet the domain password policy error:

The ability to reset/set a user’s password depends on the permissions delegated to the admin. You should prefer granular delegation on the appropriate OU/user objects rather than adding admins to broad built-in privileged groups (such as Account Operators).

PASSWD_NOTREQD is significant because it removes the normal minimum password-length requirement for the account. In some cases, an admin with sufficient permissions may be able to set an empty password, whereas the same operation is normally rejected when the flag is not set. Therefore, you should treat an enabled account with PASSWD_NOTREQD as a security finding and investigate it.

Find all enabled user accounts with the PasswordNotRequired attribute in AD

Because the PASSWD_NOTREQD flag is stored in the readable userAccountControl attribute, accounts with this flag can be identified through normal directory enumeration. An enabled account with PASSWD_NOTREQD should therefore be reviewed, especially if it is a privileged, service, or otherwise sensitive account.

Use the following PowerShell command to find all enabled user accounts with the PasswordNotRequired attribute set in AD:

Get-ADUser -Filter "PasswordNotRequired -eq 'True' -and Enabled -eq 'True'" `
-Properties PasswordNotRequired |
Select-Object SamAccountName, Enabled, PasswordNotRequired

You can also express the same search as a native LDAP filter:

Get-ADUser -LDAPFilter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" |
Select-Object SamAccountName, Enabled

The LDAP filter checks the PASSWD_NOTREQD bit directly in userAccountControl. This does not provide a general performance advantage over -Filter, because the ActiveDirectory module translates -Filter into a directory query as well. The LDAP form is useful when you need to reuse the same filter in ADUC Saved Queries, ldapsearch, or other LDAP-based tools.

To list all users with the Password Not Required flag enabled in the ADUC graphical console, create a saved query with the following LDAP query code (Saved Queries > New > Define Query > Custom Search > Advanced):

(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

Note that 32 corresponds to the PASSWD_NOTREQD flag in the userAccountControl bitmask.

Find users with the PasswordNotRequired flag enabled

Before changing the accounts, you need to export the affected users and their current userAccountControl values. This provides an audit record of the original state and allows you to verify exactly which accounts were changed. Use the command below:

$accounts = Get-ADUser -Filter "PasswordNotRequired -eq 'True' -and Enabled -eq 'True'" `
-Properties userAccountControl, PasswordNotRequired

$accounts |
Select-Object SamAccountName, DistinguishedName, Enabled, PasswordNotRequired, userAccountControl |
Export-Csv -Path .\PasswordNotRequired-before.csv -NoTypeInformation -Encoding UTF8

Keep this file as the pre-change baseline. You should not treat it as a backup that can be directly imported to restore accounts; in case rollback is required, you need to review the recorded values and restore only the intended user account settings. After reviewing the exported list, follow the steps below.

Identify enabled user accounts with the PasswordNotRequired flag set and preview the remediation with -WhatIf:

Note that -WhatIf previews the accounts that would be modified without making changes. It does not validate whether the operation will succeed; for example, clearing PASSWD_NOTREQD can trigger password-policy validation. After reviewing the results, you need to test the remediation on a small pilot group before removing -WhatIf.

Get-ADUser -Filter "PasswordNotRequired -eq 'True' -and Enabled -eq 'True'" |
    Set-ADUser -PasswordNotRequired $false -WhatIf

In some cases, you can trigger password policy validation when clearing the PasswordNotRequired flag. In case the account’s current password does not satisfy the applicable domain password policy, the change may fail with an error such as:

The password does not meet the length, complexity, or history requirement of the domain.

It means that the attempted change triggered password-policy validation and the account’s existing password does not satisfy the requirements that apply to the operation.

In such cases, you need to reset the user’s password to a compliant value before clearing the PasswordNotRequired flag.