A banned password list for on-premises Active Directory
Active Directory's password policy has no setting that prevents the use of common words that result in weak passwords. It's only natural for people to build a password they can remember from a familiar word, like the company name or the season, and attackers know those patterns well. Lithnet Password Protection for Active Directory reduces the risk of easily guessed passwords by blocking the common patterns your users rely on, so a password like Lithnet2026! never makes it into your directory.
Support plans from USD 750 a year, including 300 usersFree for every organization
New password
L1thn3t2026!
- Numbers and symbols at the ends removed
l1thn3t - Common substitutions reversed: 1 for i, 3 for e
lithnet
- Not in any breached password list
- Matches a banned word: lithnet
Password rejected
Active Directory accepts passwords like Summer2026!
Active Directory's password policy can require long and complex passwords, but it has no way to ban a word. Many users meet the complexity rules with a word they'll remember, such as the company name or the season, plus a capital letter, a number and a symbol. Summer2026! passes the complexity rules. Attackers are likely to try it because passwords like it have worked before. If you ban the word "summer" with Password Protection, your users can't set Summer2026! or the same password with a different year.
Password Protection catches banned words in disguise
People build passwords in predictable ways that attackers know well, such as an @ for an a, a 1 for an i, or a year and a symbol added to a word. Password Protection checks each new password to see whether it is just a banned word in disguise. If it is, Password Protection rejects the password. Banning a word doesn't stop your users from ever using it; it stops the predictable passwords built on it, which is why a long passphrase that includes the word is still allowed.
How Password Protection runs on your domain controllers| New password | With "lithnet", "summer" and "password" banned |
|---|---|
| Lithnet2026! | Rejected |
| L1thn3t! | Rejected |
| Summer 2026 | Rejected |
| P@55w0rd!123 | Rejected |
| warm summer evenings by the lake | Allowed |
Your users can still choose long passphrases
For example, if "blue" is banned, blue123 is rejected and myfavoritecolorisblue is allowed, in line with the NIST password guidelines.
Ban as many words as you need
You're in control of the list. Add individual words of concern, like your company and product names, or even the whole English dictionary. Good words to ban first are your company name and its abbreviations, product and brand names, the cities where you have offices, the seasons and months, and words such as "password" and "welcome".
Keep users' names out of their passwords
Password Protection can reject passwords that contain a user's own name. For example, a user whose display name is Jane Citizen can't use Citizen2026! or JaneC2026. If you turn off Active Directory's complexity rules, as the NIST password guidelines suggest, you can still keep names out of passwords with Password Protection.
Banned words catch passwords before they appear in a breach
While Password Protection can block passwords that have appeared in breached password lists, adding a banned word protects you before a common password appears in one of those lists. For example, if you ban "summer", Summer2026! and all subsequent years are rejected even if they haven't been seen in a breach yet.
Already using Microsoft Entra Password Protection?
You can run Microsoft Entra Password Protection and Lithnet Password Protection on the same domain controllers. You keep Microsoft's global banned list and add your own banned words, whole word lists and breached password lists.
Compare with Entra Password ProtectionFrequently asked questions
Are there limits to the number of banned words?
No. You can ban as many words as you like, from a handful of company and product names to entire dictionaries in every language your users speak.
Can we test a password before we turn the check on?
Yes, using our PowerShell module you can test all your rules and word lists and see the exact result before enabling any production policies.
Which Windows Server versions does it support?
Password Protection runs on x64 domain controllers with Windows Server 2016 or later.
Get started today
Support plans start at USD 750 a year, including 300 users. Lithnet Password Protection runs on your domain controllers, and a support plan ensures you have help available directly from Lithnet when you need it. We're there to help troubleshoot problems, provide advice, and ensure you are first to be notified about security fixes.