Skip to content
MitoMito Docs

AD-PWDPOL-03: Password minimum length should be retrievable
ID AD-PWDPOL-03
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Password policy
Security area Authentication
Resource type Tenant
MITRE ATT&CK T1110
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Minimum password length is one of the most effective controls against password-based attacks:

  • Brute-force resistance: Each additional character exponentially increases the time required to brute-force a password
  • Dictionary attack protection: Longer passwords are less likely to appear in common password dictionaries
  • Modern standard: NIST and Microsoft now recommend longer passwords over complex character requirements

A minimum of 14 characters aligns with current NIST guidelines and provides significantly better security than the traditional 8-character minimum. Passphrases (multiple words strung together) are an excellent way to achieve length while maintaining memorability.

Control Type

Section titled “Control Type”

Preventive

Security Recommendation

Section titled “Security Recommendation”

Configure the minimum password length to at least 14 characters (NIST SP 800-63B recommendation). Consider:

  • Using passphrases instead of complex passwords
  • Combining length with complexity for maximum security
  • Educating users on creating memorable long passwords

To configure this setting:

  1. Open Group Policy Management
  2. Navigate to the Default Domain Policy
  3. Edit: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy
  4. Set Minimum password length to 14 or more

How the Test Works

Section titled “How the Test Works”

This test retrieves the default domain password policy using Get-ADDefaultDomainPasswordPolicy and extracts the MinPasswordLength value. The test reports:

  • Current minimum password length
  • Recommended minimum (14 characters)
  • Whether the configuration meets security best practices
Section titled “Related Tests”
  • Test-MtAdPasswordHistoryCount - Checks password history enforcement
  • Test-MtAdPasswordMaxAge - Checks maximum password age
  • Test-MtAdPasswordComplexityRequired - Checks if password complexity is enforced

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.