The Enzoic Test Page is a great place to see what will be caught by the Enzoic API and policy settings. While the test page is relatively straightforward, it can sometimes be difficult to tell what each rejection notice means and which policy setting it ties back to. Below are some examples of password rejections and the policy settings that they violate.
For more information regarding the Enzoic Test Page, click here.
Password is known bad:
- This detection means that the password matched to something that is known bad in our database.
Fuzzy matching:
*Fuzzy matching is not a detection method itself, but rather it acts as a password normalization function. Because of this Fuzzy matching will always be accompanied by another policy violation.
- In this example the password was normalized by Fuzzy Matching and was then found to be known bad.
Root Passwords:
*Like fuzzy matching, Root Password is not a detection method itself, but rather a normalization function. Because of this root password match will always be accompanied by another policy violation.
- In this example, the password was stripped down to its 'root word' and then was found to be known bad.
Password contains a user’s first or last name:
- Enzoic pulls this information directly from the user's account within AD.
Password contains a user’s NT login:
- Enzoic pulls this information directly from the user's account within AD.
Password contains a user’s email address:
- Enzoic pulls this information directly from the user's account within AD.
Password contains repeating characters:
- The password contains enough repeating characters to meet the threshold of the policy setting.
