Default Behavior of Credential Auditor

The Credential Auditor feature is disabled by default and must be manually enabled through the appliance interface.

Functionality When Enabled

• Validates user passwords against known compromised credential databases during authentication.

• If a compromised password is detected, the default action is to allow the password but issue a warning to the user.

• Performs periodic credential checks once per day to proactively identify compromised credentials.

Up2Date Server Interaction

• The firewall periodically contacts SonicWall Up2Date servers to check for updated compromised credential files.

• Default Interval: Once every 24 hours.

Administrators can change the interval for periodic checks and enforce stricter actions. For more information, refer to Configuring Credential Auditor.