Find Local Accounts with Blank Passwords

<#
.SYNOPSIS
    Lists local user accounts that have a BLANK password.

.DESCRIPTION
    Enumerates enabled local accounts and tests each for an empty password by attempting
    to validate a blank credential against the local machine. Accounts that validate (or
    that error with "blank passwords aren't allowed", meaning a blank password is set but
    blocked by policy) are reported as having a blank password.

    Useful as an endpoint security-audit check. Run as administrator.

.OUTPUTS
    Objects with Username and BlankPassword for any local account found with no password.
#>

Add-Type -AssemblyName System.DirectoryServices.AccountManagement

# Validates a credential against the local SAM database; returns $true if it is accepted
$script = {
    Param($cred)
    try {
        $obj = New-Object System.DirectoryServices.AccountManagement.PrincipalContext('machine', $env:ComputerName)
        $obj.ValidateCredentials($cred.username, $cred.GetNetworkCredential().password)
    }
    catch {
        # A blank password that policy blocks still tells us the password IS blank
        if ($_.Exception.InnerException -like "*blank passwords aren't allowed*") {
            $true
        }
        else {
            Write-Warning $_.exception.message
            $false
        }
    }
}

# Enabled local accounts only
$userlist = Get-WmiObject win32_useraccount -Filter "LocalAccount=True AND disabled=False"

# A genuinely empty SecureString = a blank password to test with
[securestring]$blankpassword = New-Object securestring

# Report any account that accepts the blank password
$nopassword = foreach ($user in $userlist) {
    $credential = New-Object System.Management.Automation.PSCredential -ArgumentList $user.Name, $blankpassword
    if (. $script $credential) {
        [PSCustomObject]@{
            Username      = $user.Name
            BlankPassword = $true
        }
    }
}

$nopassword