How Lithnet Password Protection works
Password Protection is a password filter that Windows loads on each writable domain controller. It checks every password change against the rules that you set in Group Policy. These rules can include checks against the compromised password hashes and banned words that you import into its store.
Your rules come from Group Policy. The PowerShell module imports your lists into the store.
Every component runs in your own environment
| Component | Where | What it does |
|---|---|---|
| Password filter | Every writable domain controller | Lithnet Password Protection is loaded by Local Security Authority Subsystem Service (LSASS) using approved Microsoft APIs. The filter is co-signed by Microsoft, so it is fully compatible with LSA protected mode. |
| Store | A folder on each domain controller (recommended), or a file share | The store holds the compromised password hashes and banned words that you import. A local store replicates between domain controllers with DFS-R. |
| Group Policy templates | Your central policy store | Lithnet Password Protection gets its configuration from Group Policy. |
| PowerShell module | Wherever you manage the stores | The PowerShell module allows you to import compromised passwords, banned words, test passwords, and audit existing passwords in your Active Directory. |
Built to run safely on your domain controllers
Built for enterprise performance and scale
The Password Protection architecture was built to work in the largest Active Directories in the world. With customers with hundreds of thousands of users, high performance is non-negotiable.
Lithnet Password Protection prioritizes safety
There's no service more important in an organization than its Active Directory. The Password Protection code is built with best practice code safety and extended protections to ensure that nothing ever impacts domain controller operation.
Passwords never leave the domain controller
We take password security extremely seriously, and have designed Password Protection so that the passwords never leave the domain controller. In fact, they never leave the Active Directory process running on the domain controller.
Simple to install
Run the installer on each writable domain controller and then reboot. The filter is configured via Group Policy, and compromised passwords imported via PowerShell. Read the setup guide to learn more.
Every decision is logged
The filter writes every approval and rejection to the Application event log on the domain controller.
Learn more
Our documentation explains how to install, configure and manage Password Protection in detail.
Get started today
Support plans start at USD 750 a year, including 300 users. Lithnet Password Protection runs on your domain controllers, and a support plan ensures you have help available directly from Lithnet when you need it. We're there to help troubleshoot problems, provide advice, and ensure you are first to be notified about security fixes.