Doing it (use a password cracker) once or twice to present the
importance of selecting strong passwords maybe a good idea. But doing
that in the context of a security compliance initiative may cause
problems, since it will make you aware of user passwords and raise
accountability issues.
just my 2cents,
Anestis
On 1/30/07, Alexander Bolante <alexander.bolante@gmail.com> wrote:
out of curiosity - are you doing this as part of a security compliance
initiative? or just to present to your current user community the
importance of using strong passwords in adherence w/ security policy?
On 1/24/07, WALI <hkhasgiwale@gmail.com> wrote:
>
>
> I want to highlight the danger of using weak passwords on servers and users
> admin desktops. I have tested TSgrinder with a basic dictionary Brute Force
> to access Remote Desktop exploit on both servers and desktops. The problem
> here is that when connected to domain, the Account Lockout feature disables
> the account quite soon. I can only show the exploit on machines not
> connected to the domain where Domain Security policy doesn't flow down.
>
> What are other interesting and intriguing ways to present this problem? I
> also need a system to do Passwords Audit on my domain and make then 'secure
> password' policy compliance.
>
>
--
DISCLAIMER
This message contains confidential information and is intended only
for the individual named. If you are not the named addressee you
should not disseminate, distribute or copy this e-mail. Please notify
the sender immediately by e-mail if you have received this e-mail by
mistake and delete this e-mail from your system.
