> For the complete documentation index, see [llms.txt](https://docs.lithnet.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lithnet.io/password-protection/v1.0/installation/create-a-new-store.md). # Creating a new store The store is the database that contains the compromised passwords and banned words you want to prevent from being used in your environment. An empty store is created when you install the module, so you'll need to use the PowerShell module to build your store. If you didn't specify your store path when running the installer, first create a new empty folder for the store ```powershell mkdir D:\password-protection\store ``` It is recommended to exempt this folder from anti-virus scans, at least while you are building the store. It can add a considerable amount of time to the process if you do not. Next, import the PowerShell module and open the store folder ```powershell Import-Module LithnetPasswordProtection Open-Store -Path "D:\password-protection\store" ``` ## Add compromised passwords to the store The PowerShell module is now ready to use the new store folder. First, import your compromised passwords. We recommend starting with the [Have I Been Pwned](https://haveibeenpwned.com/Passwords) NTLM password list. Download the version that says `(ordered by hash)` for the best performance. Once you have the download, import them into your new store using the [Import-CompromisedPasswordHashes ](/password-protection/v1.0/advanced-help/powershell-reference/import-compromisedpasswordhashes.md)cmdlet. ```powershell Import-CompromisedPasswordHashes -Filename "D:\password-protection\pwned-passwords-ntlm-ordered-by-hash.txt" ``` > The raw NTLM hash list from HIBP requires about 17GB of disk space when uncompressed. However, once imported, these hashes only take up 6.75GB of space in the store. Populating the store takes approximately 40mins on a host with 1 x vCPU @ 2.4Ghz with 3.5Gb RAM. If you have other NTLM hash sets you want to import, you can do so. Just make sure they are in a text file, each separated by a new line. You can also choose to import any plain-text password lists that you have access to. These are imported using the[ Import-CompromisedPasswordHashes](/password-protection/v1.0/advanced-help/powershell-reference/import-compromisedpasswordhashes.md) cmdlet. Hashes.org has a large list of [cracked plain-text passwords](https://hashes.org/left.php) that you can download and import. ```powershell Import-CompromisedPasswords -Filename "D:\password-protection\hashes.org-2018.txt" ``` If you have individual passwords you want to add, you can use the[ Add-CompromisedPassword](/password-protection/v1.0/advanced-help/powershell-reference/add-compromisedpassword.md) cmdlet ```powershell Add-CompromisedPassword -Value p@ssw0rd ``` To test to see if a password is in the compromised password store, use the [Test‐IsCompromisedPassword](/password-protection/v1.0/advanced-help/powershell-reference/test-iscompromisedpassword.md) cmdlet. The cmdlet will return `true` if the password was found in the compromised store. ```powershell Test-IsCompromisedPassword -Value p@ssw0rd ``` ## Add banned words to the store The password filter can also protect against common substitutions by normalizing incoming passwords, and checking them against the banned word store. For example, adding the word `lithnet` to the banned word store, will prevent common variations such as `lithnet2018` `l1thn3t` `Lithnet!` from being used. You can read more about the [normalization rules ](/password-protection/v1.0/help-and-support/normalization-rules.md)to understand how this works in more detail. The banned word store contains the list of these words you want to prevent passwords being based on. You can load in common names in your organization, or load in the entire dictionary. The[ Import‐BannedWords](/password-protection/v1.0/advanced-help/powershell-reference/import-bannedwords.md) cmdlet is used to import a file of new-line separated words. ```powershell Import-BannedWords -Filename "D:\password-protection\english-dictionary-words.txt" ``` To add individual words use the[ Add‐BannedWord](/password-protection/v1.0/advanced-help/powershell-reference/add-bannedword.md) cmdlet ```powershell Add-BannedWord -Value "lithnet" ``` Once you have completed creating your store, you need to decide how your servers are going to access the store. We recommend using DFS-R to replicate the store to each domain controller, so they each have an up-to-date local copy. Alternatively, you can manually copy it to each domain controller, or share it from a highly-available file server. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.lithnet.io/password-protection/v1.0/installation/create-a-new-store.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.