Effective Password Policies

In "What's the Password?" February 2006, InstantDoc ID 48891, I discussed the password-resetting process and how to manage authentication so you can be assured that requests for reset passwords are legitimate and that those reset passwords are getting to the proper users. Now, let's return to the subject of passwords to discuss the core concept of Windows authentication controls and examine the role password policy plays in protecting passwords.

Defining Password Policy
Like almost any system that uses passwords for authentication, Windows lets you define requirements for keeping the passwords (and thus authentication) strong. A domain's password policy is defined in one or more Group Policy Objects (GPOs) linked to the root of the domain. (Don't confuse domain password policy with password policy for local accounts, which can also be set through GPOs.) By default, there's just one GPO at the root, and it's called Default Domain Policy. When you open this GPO and navigate to Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy, you can see the password policies that are enforced for all domain users, as Figure 1 shows. Before configuring these options, you need to clearly understand which risks a password policy addresses and which risks it doesn't. . . .