What's the Password?

Despite being a fundamental aspect of security, authentication—which provides some assurance that a user or client computer is friendly and can be trusted— doesn't always get the attention it deserves. Without authentication, you can't properly enforce authorization and access control according to a user's identity.

Misconceptions about authentication abound. This article is the first of several in which I'll explain some core concepts about Windows authentication and help you learn how to use it effectively to provide secure access to the resources in your environment. Let's begin with a deceptively simple facet of managing authentication: password resets.

The Trouble with Passwords
Most Windows environments rely primarily on password-based, single-factor authentication. Single factor signifies that only one factor—the password—is required to successfully authenticate a user. In the case of passwords, this factor is something the user knows. Although using passwords as the factor is convenient and requires no special hardware or enrollment process, authentication based on something the user knows has significant weaknesses. . . .