Active Directory Password Audit

An Active Directory password audit extracts NTLM password hashes from your domain controller and attempts to crack them offline using GPU-accelerated hardware. Unlike a password policy review, which only checks GPO settings, a password audit tests whether your users’ actual passwords can be cracked regardless of whether they meet your policy on paper. It identifies weak passwords, reused credentials, passwords found in public breaches, and service accounts with exploitable SPNs.

An AD password audit with Precursor Security starts from £2,500 for a single-domain environment with up to 5,000 accounts, and from £4,000 for multi-domain or forest-level engagements with 10,000 or more accounts. Hybrid AD and Entra ID environments are scoped individually after a discovery call. All engagements are fixed-price: we provide a formal proposal with a single line-item price before any work begins. No day-rate estimates. No surprise overruns.

No. The audit is conducted entirely offline. We extract a Volume Shadow Copy of your ntds.dit file using read-only operations. No agent is installed, no changes are made to Active Directory, and no authentication attempts are made against your live domain. The NTLM hashes are cracked on our air-gapped GPU rig, completely disconnected from your network. Your users, helpdesk, and IT team will have no awareness that the audit is taking place.

The extraction itself takes 15 to 30 minutes on-site or remotely. The cracking cycle runs for 3 to 5 days on our dedicated GPU hardware. Report preparation and delivery typically takes a further 2 to 3 business days. From scoping call to report delivery, most engagements are completed within 10 business days.

Your NTLM hashes are loaded onto our air-gapped cracking rig, a machine with no network connectivity, and are never transmitted over the internet. At the conclusion of the engagement, all extracted data is securely wiped from our equipment. A destruction certificate is available on request. We do not retain password hashes, cracked passwords, or any derivative data after report delivery. All processing takes place in the United Kingdom.

Cracked passwords are never disclosed in plain text in the report. We report the account name, the crack time, and the password category (e.g. "common dictionary word", "company name variation", "breach corpus match"). Actual plaintext passwords are communicated only to the named account holder and the engagement sponsor via an encrypted channel, and only where the engagement scope explicitly authorises this. The default report format does not include any plaintext passwords.

Password policies check configuration. They do not test reality. A policy requiring 10 characters, uppercase, and a number allows "Password1!" and "Summer2025!", both of which fall to our GPU rig in under 60 seconds. In policy-compliant environments, our audits consistently find 30 to 50 percent of passwords are crackable. Policy enforcement tells you the rules are in place. An audit tells you whether those rules are producing genuinely strong passwords.

Free tools such as Specops Password Auditor and DSInternals check whether account passwords comply with your current GPO settings and compare hashes against known breach databases via the HaveIBeenPwned k-anonymity API. What they cannot do is GPU-crack NTLM hashes. "Summer2025!" is policy-compliant and does not appear in breach databases, but on our GPU rig it is cracked in under 60 seconds. A professional audit goes beyond what any free scanner can tell you: it reveals what an attacker with a GPU rig could break, not just what already appeared in a public breach.

For hash extraction, we use ntdsutil and Volume Shadow Copy to safely copy the ntds.dit database. For cracking, we use hashcat on a dedicated array optimised for NTLM hash cracking. Breach database comparison runs against a corpus of hundreds of millions of known compromised hashes. All operations run on air-gapped infrastructure with no connection to your network.

We audit on-premises Active Directory and, where applicable, flag the password security implications of your Entra ID hybrid configuration. If you have deployed Azure AD Password Protection in audit mode, we contextualise what the audit logs are telling you and identify gaps: historical passwords set before the policy was active, pattern-based weak credentials that avoid the banned password list, and privileged accounts that require special handling. The Hybrid AD + Entra ID scope is available as a custom engagement.

The report includes: an executive summary with the percentage of accounts cracked and overall risk posture; technical findings broken down by account class (standard users, service accounts, privileged accounts); crack-time distribution analysis; Kerberoastable SPN audit results; breach database correlation findings; GPO and FGPP gap analysis benchmarked against NCSC password guidance; a prioritised remediation roadmap with specific configuration changes; and compliance evidence mapping for ISO 27001, PCI DSS, Cyber Essentials, and NHS DSPT.

The extraction requires an account with the right to create a Volume Shadow Copy of the ntds.dit database. This is typically a Domain Admin or an account with the Replicating Directory Changes privilege. We provide step-by-step guidance for the extraction process, and it can be performed by your own administrator under our supervision if preferred. The extraction takes 15 to 30 minutes and is fully reversible.

No. A password audit is a specific credential hygiene assessment: it extracts and cracks your NTLM hashes to measure password strength across your AD estate. A penetration test is a broader adversarial simulation that attempts to exploit vulnerabilities across your entire internal network. Both are often commissioned together: the penetration test identifies whether an attacker could reach your domain controller, and the password audit reveals what they would find when they get there.