Password Complexity Rules

Passwords must be at least 6 characters (regardless of minimum lengths set in security policy).  Passwords must contain characters from three of the following groups: capitals, lowercase letters, numerals, punctuation symbols.  Passwords must not include a login name, or any of a user’s real names.

Jo, JSmith, js1234, do not meet complexity rules

Joh?#n, JS2ith, Js1234, meet complexity rules

Connection to non-Windows machines requires CHAP authentication. For this, passwords are stored in an encrypted form so they can be more safely passed over a network.

To set one of these policies, right-click on it and choose Properties.

Set the number of characters required. 7 is recommended by Microsoft for most purposes. A user is free to use more.

Click OK to complete this.

The policy is now configured.

Account Policies

Malicious (or capricious) persons may occasionally attempt to guess at passwords, especially those for the administrator account. It is possible to deter this practice by locking out further attempts for a period of time.

If the Account Lockout Policy object is expanded, the pane of options is revealed.

Lockout Duration determines how long attempts at login are ignored after a specific number of failed logons. This can be anywhere between 1 and 99999 minutes (over two months) The 0 minute option locks the machine until an administrator unlocks it.

Lockout threshold determines how many wrong attempts at login are allowed before lockout. Up to 999 attempts can be allowed.  A figure of zero permits unlimited guesses at the login name and password.

The Reset Counter has its function in the following sort of scenario: A user mistypes her password a couple of times and, to avoid the inconvenience of being locked out for the next half hour, chooses to wait a shorter period of time before making another  hopefully correct attempt.

There is a logical connection between these three lockout policy settings, and a change in one has an implication for the others. By way of illustration, right-click on the Lockout Threshold item and select Properties.

Select a sensible figure for the number of invalid logon attempts, and see what happens when OK is clicked.

Whichever option is set, this dialogue box appears to suggest reasonable settings for the other two. Click OK to review all the settings which result.

The suggested selection of settings is usually entirely reasonable