Categories Reviews

Review of Specops Password Auditor

Product: Specops Password Auditor

Learn more/Product Homepage: click here

Download Free: click here

One of the most important things that any organization can do to keep its resources secure is to practice good password security. But how do you know if your passwords measure up? Specops has a free tool called Password Auditor that claims to be able to help. I decided to take Specops Password Auditor for a test drive to see how well it works.

Installation process

Normally when I write a review, I like to try to install and use the product without looking at the documentation, because that way I can get a feel for how intuitive the software is. In this case, however, Specops sent me an email message containing several different links, and I accidentally clicked on the link to the installation documentation. As you can see from this link, the installation process could not be easier. The entire process consists of downloading the software and running a very simple Setup Wizard. In my case, the entire installation process (not counting the download) took less than ten seconds to complete.

Performing a password audit

When you launch Specops Password Auditor, you will be taken to a screen like the one that is shown in the figure below. As you can see in the figure, Specops has made it extremely easy to get started. All you have to do is to enter the name of your domain, and the fully qualified domain name of a domain controller within the domain, and then click the giant Start button. As if that were not easy enough, the Domain and Domain Controller fields were pre-populated on my test server, so I did not even have to provide Specops Password Auditor with any information. All I had to do was to click the Start button.

This is the screen that is displayed when you launch Specops Password Auditor for the first time.

Before I begin talking about the scanning process, I want to point out some of the things that are displayed on the screen shown in the figure above. I absolutely love the fact that the software explains exactly what is going to happen, and how the information that it collects will be used. There is no technical jargon and no ambiguity. The software essentially tells you that it is going to scan your Active Directory and compare the settings within it to industry standards and best practices in order to generate a collection of reports. Furthermore, the screen tells you in no uncertain terms of the software will read information from the Active Directory, but will not make any changes.

Active Directory Scan

After clicking the Start button, I was taken to a screen that asked me if I wanted to perform a blacklist scan. As you can see in the figure below, Specops Password Auditor has the ability to download a database of vulnerable passwords so that the passwords used within the Active Directory environment can be compared against those passwords. For example, passwords that were exposed during data breach leaks are included in the database.

Specops Auditor allows you to download a list of vulnerable passwords.

As you look at the screen capture above, there are two things that are worth paying attention to. First, the list itself is multiple gigabytes in size, so it is quite comprehensive. The version that I downloaded while writing this review was 4.56GB in size. Second, the list has an associated version number, so Specops presumably keeps the list up to date.

Once I finished downloading the vulnerability list, I restarted the software (even though a restart wasn’t actually required) and reinitiated the scanning process. When writing a software review, I almost always evaluate the software in a lab environment rather than trying it out in a production environment. This particular lab environment has a very small number of users, so I assumed that the scan would be fast. In actuality, the scan completed so quickly that if I had blinked, I would have missed it.

The scanning process completed very quickly.

The results screen displays various key statistics in a dashboard view. Key information is displayed in a series of boxes that make it very easy to digest the information. As you look at the figure below, for example, you can see that I have one account that has administrative access, and I have four accounts in which passwords are not required. I can also see that the password policies are based on settings within the domain. The Password Policy Compliance box shows a red indicator next to my domain, indicating that there are some password policy settings that need to be stronger.

This is what the scan results look like.

As you look at the figure above, something else that you may notice is that the first three boxes are yellow, while the other boxes are blue. The yellow boxes provide summary information, but not details. For example, I can see that one account has a blank password, three accounts are using blacklisted passwords, and the Administrator account and two other accounts are using the same password as one another.

The reason why Specops Password Auditor only provides summary information without the relevant details is because Specops Password Auditor is a free product. If you want to know details such as which user has a blank password, which users have duplicate passwords, and who is using blacklisted passwords, then you will need to get a different Specops product called Specops Password Policy.

Although none of the user accounts in my lab environment had expired passwords, I once wrote a review for the previous version of the product. At the time of that review, Specops Password Auditor identified four accounts with expired passwords. I found that by clicking on the Expired Passwords box, I was able to determine which accounts had expired passwords, and could use that information to help to identify stale accounts that might pose a security risk.

So with that said, I want to go back to something that I briefly mentioned earlier. The Password Policy Compliance box contains a colored indicator that reflects the password policy’s health. In my case, this indicator was red. I found that if I click on this indicator, I am taken to a screen like the one shown below that lists various industry standards such as NIST and PCI. For each standard, there is an indicator icon that tells whether the current password policy is compliant, partially compliant, or non-compliant with the policy.

This is what the Password Policy Compliance screen looks like.

You can click on any one of these standards to see the areas in which your password policy does not measure up. As you can see in the figure below, Password Auditor does not clutter your screen with settings that are OK the way that they are. It only shows you the settings that you might want to address.

You can see the exact policy settings that are out of compliance.

The verdict

When I write a review for this site, I give it a rating from zero to five stars (with five stars being the highest possible rating). Although many of the applications that I have reviewed over the years have received favorable scores, I have only given a perfect score on the rarest of occasions. I believe that there is almost always something that can be improved.

In this case, however, I am breaking my own rule and giving Specops Password Auditor a perfect score. The software works flawlessly, the documentation is well written (not that you will need it), the software is easy to use, you can get it for free, and most importantly, it does something useful. I simply cannot justify giving Specops Password Auditor anything other than a well deserved perfect score.

Rating 5/5

Learn more about Specops Password Auditor or download free.

Editor's Note: This article is an update of a review of an earlier version of the product originally published in March 2018. The earlier version of the product also received a 5.0 Gold Award rating.

Brien Posey

Brien Posey is a freelance technology author and speaker with over two decades of IT experience. Prior to going freelance, Brien was a CIO for a national chain of hospitals and healthcare facilities. He has also served as a network engineer for the United States Department of Defense at Fort Knox. In addition, Brien has worked as a network administrator for some of the largest insurance companies in America. To date, Brien has received Microsoft’s MVP award numerous times in categories including Windows Server, IIS, Exchange Server, and File Systems / Storage. You can visit Brien’s Website at:

Published by
Brien Posey

Recent Posts

Diebold Nixdorf ATMs targeted by jackpotting attacks

ATM manufacturer Diebold Nixdorf says its European machines are being hit by jackpotting attacks, where…

13 hours ago

Allow a home computer to connect to your Azure SQL server/database

In these days where remote computing has become crucial, you can connect your home computer…

16 hours ago

Migrating to Microsoft 365? Get the ball rolling with a trial tenant

Many companies still using Exchange Server are thinking of moving to Microsoft 365. You can…

19 hours ago

wpDiscuz WordPress plugin: Critical vulnerability found and patched

Users of the wpDiscuz interactive comment WordPress plugin should implement a new patch as soon…

2 days ago

Data lifecycle management: Policies and procedures for security and compliance

With the amount of electronic information consistently growing, data lifecycle management is crucial for compliance…

2 days ago

Deploy Windows from the cloud to on-premises hardware? Yes, you can

Wouldn’t it be nice if you could deploy Windows from the cloud while sipping an…

5 days ago