Specops Password Policy

Specops Password Policy is a tool for managing fine-grained password policies in Active Directory. It includes an Active Directory password screening service that checks new passwords against a continuously updated list of billions of compromised or breached passwords, including datasets from major breach incidents such as the Collection leaks and the Have I Been Pwned list. During a password change in Active Directory, the service blocks and notifies users if their chosen password appears on the leaked password list. Organizations can also build custom dictionaries containing organization-specific terms, such as company name, location, services, and industry acronyms, to block additional high-probability or targeted passwords. The product supports settings to prevent users from bypassing dictionary checks through predictable patterns, such as character substitution or appending numbers. It is designed to help organizations align with NIST Digital Identity Guidelines (SP 800-63B), which recommend screening passwords against lists of commonly-used, expected, or compromised values. By enforcing these screening measures, the tool aims to reduce reliance on complex composition rules and frequent forced password changes, while lowering support burden and improving the end-user password experience.