Windows Server Cookbook for Windows Server 2003 and Windows 2000

2017-07-07 02:10:07

Recipe 11.7. Requiring Strong Passwords

Problem

You want to enforce the use of strong passwords for user accounts.

Solution

Using a graphical user interface

Open the Group Policy Object Editor and target the Default Domain Policy.

In the left pane, expand Computer Configuration Windows Settings
In the right pane, double-click Password must meet complexity requirements.

Make sure the box beside Define this policy setting is checked and Enabled is selected.

Click OK.

This setting does not have any effect on users' current password. Password complexity is required only after each users' current passwords. For more on how to force users to change their password, see Recipe 6.21 in Active Directory Cookbook (O'Reilly).

Discussion

Most users, if given a choice, pick really simple, easy to remember passwords. No matter how tight the security is on your servers, if an attacker can crack a user's password, it is all for naught. To combat this, you can enable password complexity on the Default Domain GPO to require users to choose a password that meets the following criteria:

Not contain any part of the user's account name

Contain at least six characters

Contain characters from three of the following:
- Uppercase
- Lowercase
- Digits
- Special character (e.g., %(@!)

By enabling this, you can feel a little better that once a user changes his password, that it won't be something trivial (although passwords such as "Mypassword!" still pass the complexity test).