diff --git a/Src/DSInternals.PowerShell/Commands/Misc/TestPasswordQualityCommand.cs b/Src/DSInternals.PowerShell/Commands/Misc/TestPasswordQualityCommand.cs index 4210b43..990b156 100644 --- a/Src/DSInternals.PowerShell/Commands/Misc/TestPasswordQualityCommand.cs +++ b/Src/DSInternals.PowerShell/Commands/Misc/TestPasswordQualityCommand.cs @@ -234,7 +234,11 @@ // Skip the remaining tests, because they only make sense for non-empty passwords. return; } - + if (this.Account.SamAccountType == SamAccountType.User) + { + // Check if the user has the SamAccountName as password. + this.TestSamAccountNameAsPassword(); + } if (this.Account.SamAccountType == SamAccountType.Computer) { // Check if the computer has a default password. @@ -466,6 +470,28 @@ accountList.Add(this.Account.LogonName); } + private void TestSamAccountNameAsPassword() + { + string userLowerPassword = this.Account.SamAccountName.ToLower(); + string userExactPassword = this.Account.SamAccountName; + byte[] userLowerHash = NTHash.ComputeHash(userLowerPassword); + byte[] userExactHash = NTHash.ComputeHash(userExactPassword); + if (HashEqualityComparer.GetInstance().Equals(this.Account.NTHash, userLowerHash)) + { + // Username Password is lowercase SamAccountName + + this.result.SamAccountNameAsPassword.Add(this.Account.LogonName); + } + else + { + if (HashEqualityComparer.GetInstance().Equals(this.Account.NTHash, userExactHash)) + { + // Username Password is exact SamAccountName + this.result.SamAccountNameAsPassword.Add(this.Account.LogonName); + } + } + } + private void TestComputerDefaultPassword() { string defaultPassword = this.Account.SamAccountName.TrimEnd('$').ToLower(); diff --git a/Src/DSInternals.PowerShell/Types/PasswordQualityTestResult.cs b/Src/DSInternals.PowerShell/Types/PasswordQualityTestResult.cs index 608e21e..62c0744 100644 --- a/Src/DSInternals.PowerShell/Types/PasswordQualityTestResult.cs +++ b/Src/DSInternals.PowerShell/Types/PasswordQualityTestResult.cs @@ -27,6 +27,11 @@ /// public ISet WeakPassword = new SortedSet(); + /// + /// List of user accounts with SamAccountName as passwords. + /// + public ISet SamAccountNameAsPassword = new SortedSet(); + /// /// List of computer accounts with default passwords. /// diff --git a/Src/DSInternals.PowerShell/Views/DSInternals.PasswordQualityTestResult.format.ps1xml b/Src/DSInternals.PowerShell/Views/DSInternals.PasswordQualityTestResult.format.ps1xml index 4806461..2509378 100644 --- a/Src/DSInternals.PowerShell/Views/DSInternals.PasswordQualityTestResult.format.ps1xml +++ b/Src/DSInternals.PowerShell/Views/DSInternals.PasswordQualityTestResult.format.ps1xml @@ -89,6 +89,12 @@ DuplicatePasswordGroups AccountGroupList + These user accounts have the SamAccountName as password: + + + SamAccountNameAsPassword + AccountList + These computer accounts have default passwords: