Password Policies

Everyone needs a password policy. The password policy settings in Group Policy help you enforce it, and the options in there are relatively self-explanatory. The exact options to configure vary by environment, but in virtually all enterprise environments you should enforce at least 7-character complex passwords that change no less often than 180 days. In many, if not most, environments, you probably want to go to 8-character complex passwords that change every 90 days.

You cannot enforce some things using the built-in policies, however. For example, in many environments, we make policies such that administrators cannot use the same password on two different systems. Since you cannot enforce that with built-in technical means, we need a different way to do so. One option that works is to use a logon script. For example, if you are not allowed to use the same password on system A as on system B, you put a logon script on system A that connects, without specifying credentials, to system B, and vice versa. If the connection succeeds, you have a violation of the policy. At this point, you can automatically generate a termination notice or take some other appropriate action.