11
Minimum Password Age
Domain Member
Default
Legacy Client
Enterprise Client
High Security Client
1 day
2 days
2 days
2 days
The
Minimum password age
setting determines the number of days that a password must be used
before a user changes it. The range of values for this setting is between 0 and 999 days. Setting this
to 0 allows users to change the password immediately. The default value for the setting is
1
day. The
Minimum password age
setting must be less than the
Maximum password age
setting, unless the
Maximum password age
setting is set to
0
, indicating that passwords will never expire. In this case,
the
Minimum password age
can be set to any value between 0 and 999. The
Minimum password
age
must
be greater than 0 for the
Enforce password history
to be effective. Without a
minimum
password age
, users can cycle through passwords repeatedly until they get to an old favorite.
Change this setting from the default to
2
days because when the setting is used in conjunction with a
similar low value in the
Enforce password history
setting, the restriction discourages users from
recycling the same password again and again. If
Minimum password age
is left at 1 day, and the
Enforce password history
is set to 2 passwords, users would only have to wait 2 days before arriving
at an old favorite password. This setting value ensures that users must wait a full two days to change
passwords. The default setting does not follow this recommendation, so that an administrator can
specify a password for a user and then require the user to change the administrator-defined password
when the user logs on. If the password history is set to 0, the user does not have to choose a new
password. For this reason,
Enforce password history
is set to 1 by default. It also prevents users from
circumventing the
Password history setting
restriction by rapidly setting 24 new passwords.
Minimum Password Length
Domain Member
Default
Legacy Client
Enterprise Client
High Security Client
7 characters
8 characters
8 characters
12 characters
The
Minimum password length
setting ensures passwords have at least a specified number of
characters. Long passwords, which are eight or more characters, are usually stronger than short ones.
With this policy setting, users cannot use blank passwords, and they must create passwords that are a
certain number of characters long. The default value for this setting is
7
characters, but an eight-
character password is recommended as it is long enough to provide some level of security, but still
short enough for users to easily remember. This setting will provide a great deal of defense against
the commonly used dictionary and brute force attacks. A dictionary attack is a method of obtaining a
password through trial and error in which an attacker uses all items in a word list. A brute force
attack is a method of obtaining a password or other encrypted text by trying every possible value.
The feasibility of a brute force password attack depends on the length of the password, the size of the
potential character set, and the computational power available to the attacker. This guide
recommends setting the value for password length in the High Security environment to 12 characters.
Passwords are stored in the Security Accounts Manager (SAM) database or Active Directory after
being passed through a one way hash algorithm. This type of algorithm is not reversible. Therefore,
the only way to verify that a password is correct is to run it through the same one way hash algorithm
and compare the results. Dictionary attacks run entire dictionaries through the encryption process,
looking for matches. They are a simplistic, yet very effective, approach to finding out who has used
common words like "password" or "guest" as their account passwords. If a password is seven
characters or less, the second half of the LM Hash resolves to a specific value that can inform a
cracker that the password is shorter than eight characters. Requiring passwords with at least eight
characters strengthens even the weaker LMHash because the longer passwords require crackers to
decrypt two portions of each password instead of only one. Since hackers can attack both halves of
