The existence of user accounts with blank passwords is a common and often ignored vulnerability in Active Directory. Even though AD password policies enforce minimum password length (defined via Default Domain Policy/Fine-Grained Password Policies; no fixed default value, commonly 8+ characters in enterprise environments) and password complexity, there may be accounts in the domain with empty passwords. Keep in mind that the PASSWD_NOTREQD does not bypass domain password policy. It only allows a user account to exist without a required password at creation time (but password operations are still subject to domain policy enforcement).
What is PASSWD_NOTREQD?
PASSWD_NOTREQD is one of the userAccountControl attribute flags. Unlike other AD account options, the PasswordNotRequired flag cannot be set from the properties of an AD user account object in the AD Users and Computers (ADUC) snap-in GUI. This attribute can only be set by manipulating the userAccountControl attribute value in the Attribute Editor tab or programmatically using PowerShell.
Security impact. Note that accounts with PASSWD_NOTREQD enabled represent a high-risk authentication config and you should treat it as a security misconfig in enterprise AD environments.
Using PasswordNotRequired
Check that the PasswordNotRequired option is enabled for the user:
Get-ADUser i.maier -properties *| Select SamAccountName,PasswordNotRequired
Run the following command to set this flag for a user:
Get-ADUser i.maier -properties *| Set-ADUser -PasswordNotRequired $true
Also, administrator can set this flag by changing the userAccountControl value from 512 (NORMAL_ACCOUNT) to 544 = NORMAL_ACCOUNT (512) + PASSWORD_NOTREQD (32). See the post explaining the userAccountControl attribute.
Password does not meet the domain password policy error
The user cannot change his password to a blank one, even after the PasswordNotRequired flag is enabled. If the user tries to change a password to an empty one, he gets the “Password does not meet the domain password policy” error.
Only domain admins or users with delegated Account Operator privileges can set a blank password when PasswordNotRequired is enabled.
Keep in mind that in properly secured modern AD environments, setting an empty password is typically blocked regardless of PASSWD_NOTREQD. In case you observe an ability to do so, it usually indicates legacy config/non-standard admin workflows.
Find all enabled user accounts with the PasswordNotRequired attribute in AD
Because the user accounts with empty flags can be easily discovered by any other domain user, their presence in Active Directory poses a high security risk (especially if those accounts are privileged). It is extremely easy for an attacker to compromise an AD user account configured with a password-not-required or blank password.
Use the following PowerShell command to find all enabled user accounts with the PasswordNotRequired attribute set in AD:
Get-ADUser -Filter {PasswordNotRequired -eq $true -and Enabled -eq $true} -properties * | Select SamAccountName, Enabled, PasswordNotRequired 
To list all users with the Password Not Required flag enabled in the ADUC graphical console, create a saved query with the following LDAP query code (Saved Queries > New > Define Query > Custom Search > Advanced):
(&(&(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))))
Note that 32 corresponds to the PASSWD_NOTREQD flag in the userAccountControl bitmask.
List users who are not allowed to have a password
Or you can list users who are not allowed to have a password by using the userAccountControl bitmask and then immediately reset this flag:
Get-ADUser -Filter "Enabled -eq 'True'" -Properties userAccountControl |
Where-Object { $_.userAccountControl -band 32 } |
ForEach-Object {
Set-ADAccountControl $_.SamAccountName -PasswordNotRequired $false -WhatIf
}
Note that you should validate this operation in a test environment before production execution.
Keep in mind that Set-ADAccountControl may fail if the account does not currently satisfy domain password policy requirements. This error is not directly caused by a blank password, but by a password validation check triggered during the modification of the userAccountControl attribute:
Set-ADAccountControl : The password does not meet the length, complexity, or history requirement of the domain.
In such cases, you need to ensure that the account has a compliant password before modifying the userAccountControl flags.
You should first reset a user’s password to the one that meets the password policy.
What is the PasswordNotRequired (PASSWD_NOTREQD) attribute in Active Directory?
PasswordNotRequired is a flag in the userAccountControl attribute that allows a user account to be created without requiring a password at creation time. It is represented by the value PASSWD_NOTREQD (32).
Does PASSWD_NOTREQD bypass Active Directory password policy?
No. It does not bypass domain password policy. It only allows an account to exist without a required password initially, but password changes and enforcement still follow domain rules (length, complexity, history, etc.).
What is the userAccountControl value for PasswordNotRequired?
- NORMAL_ACCOUNT = 512
- PASSWD_NOTREQD = 32
- Combined value = 544
So:ย 512 + 32 = 544
Why is PasswordNotRequired considered a security risk?
Accounts with this flag:
- May indicate weak or legacy configuration
- Can be easier to exploit if combined with weak authentication controls
- Are often overlooked during security audits
Even if not directly exploitable, they represent a misconfiguration risk in enterprise AD environments.
Can a user set a blank password if PasswordNotRequired is enabled?
No. In secure modern Active Directory environments:
- Blank passwords are typically blocked
- Password policy enforcement still applies
If blank passwords are allowed, it usually indicates:
- Legacy system configuration
- Misconfigured domain policies
- Non-standard administrative practices
