Skip to content
MitoMito Docs

AD-PWDPOL-01: Password history count should be retrievable
ID AD-PWDPOL-01
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Password policy
Security area Authentication
Resource type Tenant
MITRE ATT&CK T1110.004
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Password history is a critical security control that prevents users from reusing their recent passwords. Without adequate password history:

  • Password cycling: Users can quickly cycle through passwords to return to their favorite (often compromised) password
  • Compromised credential reuse: If a password is breached, users may inadvertently reintroduce it into the environment
  • Weak compliance: Many compliance frameworks require password history to prevent password reuse

The recommended minimum of 24 remembered passwords ensures that users cannot reuse passwords within a reasonable timeframe, forcing them to create truly unique passwords.

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

Configure the password history count to at least 24 (Microsoft and CIS recommendation). This prevents users from reusing their last 24 passwords, significantly reducing the risk of password reuse attacks.

To configure this setting:

  1. Open Active Directory Domains and Trusts or Group Policy Management
  2. Navigate to the Default Domain Policy
  3. Edit: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy
  4. Set Enforce password history to 24 or more

How the Test Works

Section titled “How the Test Works”

This test retrieves the default domain password policy using Get-ADDefaultDomainPasswordPolicy and extracts the PasswordHistoryCount value. The test reports:

  • Current password history count
  • Recommended minimum (24)
  • Whether the configuration meets security best practices
Section titled “Related Tests”
  • Test-MtAdPasswordMaxAge - Checks maximum password age
  • Test-MtAdPasswordMinLength - Checks minimum password length
  • Test-MtAdPasswordComplexityRequired - Checks if password complexity is enforced

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.