Skip to main content

Test Policy

You can check if your Password Policy Enforcer (PPE) policies meet your requirements by clicking Test policy in the home page above the policy list, or in the upper-right of the policy editor.

warning

You must save any pending configuration changes before clicking Test policy in the policy editor, otherwise the Configuration Console discards your unsaved changes.

Use the two tabs at the top of the Test Policy dialog to select the type of test. Select By user to test individual passwords for a specific user. Select Password bulk test to test passwords in a file against a specific policy.

By user​

Use the By user test to quickly check policy changes, or to help understand why PPE accepts or rejects a particular password. This test simulates a password change, but it doesn't change the password.

Enter a username in the first text box, or click Select to display a user search and selection dialog.

Enter a test password in the second text box. PPE tests the password when you stop typing. An icon in the text box indicates whether the password complies with the policy assigned to the chosen user.

The right pane shows additional information, starting with the policy assigned to the user, followed by the rules for the policy and their test pass/fail status.

If you're not sure why PPE accepted or rejected the password, then click View log in the right pane to show additional troubleshooting information, including:

  • The computer the Configuration Console read the configuration from.
  • Any dictionary word or keyboard pattern matched with the password.
  • Any errors or warnings that occurred during testing.

If the information in the log doesn't explain why PPE accepted or rejected the password, then enable the Verbose logging toggle switch at the bottom of the dialog box. This opens a second pane with additional troubleshooting information from every enabled rule. You can click the name of any rule with a > beside its name to show all the events logged by that rule.

Password bulk test​

Use the Password bulk test to test a password policy against a list of passwords in a text file. You can use this feature to fine-tune your policy and to see how effective it is against a list of compromised passwords or cracking dictionaries.

Select a policy to test from the dropdown, then click Browse to select the text file. The file should have one password on every line.

The default test report includes all accepted and rejected passwords, and PPE saves the report to the %ProgramFiles%\Netwrix\Password Policy Enforcer\ folder. To change the defaults, click Report settings.

Click Test passwords to begin the test. The Configuration Console shows a progress bar along with some statistics in the right pane. You can click Cancel to terminate the test.

When the test completes, click Show full report in the right pane to view the report in a web browser. The report contains some summary statistics along with the rejected and accepted password lists, if you chose to show them in the report settings. Click Copy above a list to copy it to the clipboard, or click Save to save it to a text file.

Policy testing vs. password changes​

Policy testing simulates a password change, but it may not always reflect what happens when a user changes their password. A password change may yield different results to a policy test because:

  • Policy testing doesn't simulate the Windows password policy rules. If you enable the Windows rules, then Windows may reject a password even though it complies with the PPE policy.
  • Policy testing doesn't simulate the Minimum Age rule.
  • Policy testing doesn't simulate the History rule.
  • Policy testing simulates the policy even if PPE or the policy are disabled. Use this behavior to test your configuration before enabling PPE or a new password policy.
  • Policy testing occurs on the computer that the Configuration Console is running on. If the Configuration Console is connected to a domain configuration, then it may not find the dictionary file or compromised database on the local computer, or they may be different from the ones on the domain controller. Copy the files onto the local computer (in the same paths as the domain controller) to avoid this problem.
  • If the Configuration Console is connected to a domain configuration and you recently modified the PPE configuration, then Active Directory may still be replicating the new configuration to the other domain controllers.

Installing and Deploying the Policy Tester Module​

You can install the Policy Tester .EXE to a moveable folder and distribute it to a location that Helpdesk Engineers can access.

note

Engineers must open the .EXE using a user account with Read access to the Active Directory object that stores the Password Policy Enforcer configuration. The object name is "Password Policy Enforcer X.0" (where X is the major version number), and it resides in Active Directory Users and Computers > System. To view it, enable Advanced Features under the View menu in Active Directory Users and Computers.

Step 1 – Navigate to the installation folder at Program Files > Netwrix > Password Policy Enforcer.

Step 2 – Run PPEPolicyTestInst.exe and select an installation location.

note

This installation requires .NET, per the Server section of the installation documentation. The machine that runs the Test Policy Module also requires .NET.

Step 3 – If you install the module to a location other than where Engineers will access it, move the installed files to the accessible location.

Step 4 – Engineers can then launch PPEPolicyTest.exe to run the module.

Join the machine running the Test Policy Module to the same domain so that the module can retrieve the required information.