Security

Ask something
Discussion Locked

IMPLEMENT PASSFILT.DLL ON NT4 SERVER

0 helpful
3 replies

by mozster

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We are about to enforce strong passwords on our NT 4 PDC by using PASSFILT.DLL and creating the appropriate registry key to point to it as per Microsofts documentation.

However once this is done and the server rebooted does it just start working the next time a user changes their password or does it require all the existing user passwords to be changed immediately to satisfy its conditions?

3 replies

by joseph moore

When you put PASSFILT in the REgistry on your PDC and reboot it, then the next password change will be applied against this filter. Any existing passwords will NOT be subject to its conditions. Only new password changes that take place once that PDCis back up will be compaired to the filter parameters.
So, put PASSFILT on, reboot, then make sure your users accounts all have passwords that will expire at some point. You can change the Maximum Password Age account setting to a couple of days toforce the passwords to need to be reset.
When we rolled out PASSFILT at my company, we already were running Max Password Age at 30 days. I put PASSFILT on and let the user passwords expire as they normally did.
This meant I got a steady stream ofcomplaints on the new password parameters for a whole month! That was the only bad thing ;-)

Check out Technet article Q161990 on PASSFILT. Sure, it will be an annoyance for your users, but it looks great if you get audited for security, and it is a good thing to have in place.
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q161990
(please remove any spaces)

hope this helps

This discussion is closed to new replies.