Software

Ask something
Question Locked

Complex Password Setting

0 helpful
4 replies

by jbm

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I would like to enable the complex passowrd setting on my Active Directory Domain Controller but would like to know what to expect from my clients and user systems once this option is enabled. Will they be prompted to change their passwords the first time they logon once the option is activated? If their passwords do not meet the complex standard will they be dissabled? Any info will be helpful...

4 replies

by dawgit

a warning first.!. Really, first you should get / make a policy explaining exactally what you'd like to see in a password, give examples. ie:
"Notice to users"
"effective xx Feb. '07 Passwords must be updated. Under the guide lines established by xxxxx, and apropriate Gov. Guide Lines, (or even regulations) (there are BTW, depending on your particluar business) Passwords must be 8, or 10 (whatever you choise) charaters long. They must contain at least 2 'Numerals', 2 'Special Charaters' (show here !"?$&%=#+ ect.) 2 'lower case Letters' and 2 'upper case Letters. After xx Feb. '07 the old paswords will be no longer valid."
There, now this should be at least a month out, then at 3 weeks before, then 2 weeks before, then 1 week, than every day. On, or maybe the next day, set the AD so that Complex Passwords ONLY are acepted. Of course this policy should be approved from the top, and from then on 'THE' Policy.
Sounds easy, no? It actually is. When you do it in such a way as I sugested, (ok, not exactaly, that was just an example, but I think you got the point.) You will have less problems and complaints from the users. -d

by lowlands

the great procedural comments made by Dawgit, your users will not be diabled or forced to change their password until their current password expires. So they can keep using whatever password they now have, but the next time they change it, it has to be complex.

by inkling

Might I suggest checking out the SANS website: http://www.sans.org/resources/policies/

As Dawgit said, this should be the first step in instituting these kind of changes.

It will also CYA when all the managers want special exceptions because they can't be bothered to remember something like that.

This discussion is closed to new replies.