Contents
How do you write a password policy?
All passwords are to be treated as sensitive, confidential information. Passwords should never be written down or stored on-line without encryption. Do not reveal a password in email, chat, or other electronic communication. Do not speak about a password in front of others.
What is not best practice for password policy?
Don’t make passwords easy to guess. Do not include personal information such as your name or pets’ names easily to find on social media. Avoid using common words in your password. substitute letters with numbers and punctuation marks or symbols.
What is the purpose of a password policy?
A password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly. A password policy is often part of an organization’s official regulations and may be taught as part of security awareness training.
Where can I find the password policy settings?
There are password policy settings that control the complexity and lifetime of passwords, such as the Passwords must meet complexity requirements policy setting. You can configure the password policy settings in the following location by using the Group Policy Management Console:
What kind of password policy do I Need?
The domain must be running at least Windows Server 2008 R2 or Windows Server 2008 to use fine-grained password policies. Fine-grained password policies cannot be applied to an organizational unit (OU) directly. You can enforce the use of strong passwords through an appropriate password policy.
Can a domain admins set a password policy?
When you specify a fine-grained password policy, you must specify all of these settings. By default, only members of the Domain Admins group can set fine-grained password policies. However, you can also delegate the ability to set these policies to other users.
What does NIST say about passwords and security?
The National Institute of Standards and Technology (NIST) addressed the question of password policies by issuing NIST Special Publication 800-63B (Digital Identity Guidelines – Authentication and Lifecycle Management). Section 5.1.1 “Memorized Secrets” has much to say about passwords and how they should be managed and stored.