Contents
How to enforce the use of strong passwords?
You can enforce the use of strong passwords through an appropriate password policy. There are password policy settings that control the complexity and lifetime of passwords, such as the Passwords must meet complexity requirements policy setting.
What kind of password policy do I Need?
The domain must be running at least Windows Server 2008 R2 or Windows Server 2008 to use fine-grained password policies. Fine-grained password policies cannot be applied to an organizational unit (OU) directly. You can enforce the use of strong passwords through an appropriate password policy.
How to enforce a fine grained password policy?
To apply a fine-grained password policy to users of an OU, you can use a shadow group. A shadow group is a global security group that is logically mapped to an OU to enforce a fine-grained password policy. You add users of the OU as members of the newly created shadow group and then apply the fine-grained password policy to this shadow group.
Where can I find the password policy settings?
There are password policy settings that control the complexity and lifetime of passwords, such as the Passwords must meet complexity requirements policy setting. You can configure the password policy settings in the following location by using the Group Policy Management Console:
When do you need to enforce a password policy?
If password changes are required but password reuse is not prevented, or if users continually reuse a small number of passwords, the effectiveness of a good password policy is greatly reduced. If you specify a low number for this policy setting, users can use the same small number of passwords repeatedly.
How to enforce and monitor password requirements for users?
In the Strength section, check the Enforce strong password box. Strong passwords use a mix of letters, numbers, and symbols, and should not be common or previously used. In the Length section, enter a minimum and maximum length for your users’ passwords.
What should the enforce password history setting be?
Configure the Enforce password history policy setting to 24 (the maximum setting) to help minimize the number of vulnerabilities that are caused by password reuse. For this policy setting to be effective, you should also configure effective values for the Minimum password age and Maximum password age policy settings.