12
the LM hash in parallel, the second half of the LM hash is only 1 character long; it will succumb to a
rute-force attack in milliseconds. Also, each additional character in a password increases its
complexity exponentially. For instance: A seven-digit password would have 267, or 1 x 107, possible
combinations. A seven character alphabetic password with case sensitivity has 527 combinations. A
seven haracter case-sensitive alphanumeric password without punctuation has 627combinations. At
1,000,000 attempts per second, it would only take 48 minutes to crack. An eight-character
password has 268, or 2 x 1011, possible combinations. On the surface, this might seem a mind-
boggling number. However, at 1,000,000 attempts per second, a capability of many password-
cracking utilities, it would take only 59 hours to try all possible passwords. Remember these times will
greatly increase with passwords that use ALT characters and other special keyboard characters, for
example ! or @. For these reasons, using shorter passwords in place of longer ones is not
recommended. However, requiring passwords that are too long may generate a high number of
mistyped passwords, resulting in an increase in locked out accounts and help desk calls.
Furthermore, requiring extremely long passwords can actually decrease the security of an
organization because users may be more likely to write their passwords down in fear of forgetting
them.
Password Must Meet Complexity Requirements
Domain Member
Default
Legacy Client
Enterprise Client
High Security Client
Enabled Enabled Enabled Enabled
The
Password must meet complexity requirements policy
option checks all new passwords to ensure
that they meet basic requirements for strong passwords. Complexity requirements are enforced when
passwords are created. The Windows Server 2003 policy rules cannot be directly modified.
However, a new version of the passfilt.dll file can be applied with a different set of rules. For the
source code for passfilt.dll, see the Microsoft Knowledge Base article 151082 at
http://support.microsoft.com/default.aspx?kbid=151082
labelled "HOW TO: Password Change Filtering &
Notification in Windows NT." A password of 20 or more characters can actually be set so that it is
easier for a user to remember and be more secure than an eight-character password. The following
27-character password:
I love cheap tacos for $.99,
for example. This type of password, really a
pass-phrase, might be simpler for a user to remember than a shorter password such as
P@55w0rd.
This recommended value, combined with a
Minimum password length
set to
8,
includes upper and
lowercase letters and numbers in the keyspace, which increases it from 26 to 62 characters. An eight-
character password then has 2.18 x 10
14
possible combinations. At 1,000,000 attempts per second,
it would take 6.9 years to cycle through all possible permutations. Using these settings in conjunction
makes it very difficult to mount a brute force attack. For these reasons, this is the recommendation the
three environments defined in this guide.
