10
•
Enforce using passwords that require users to type with both hands on the keyboard.
•
Enforce using uppercase and lowercase letters, numbers, and symbols in all passwords.
•
Enforce using space characters and characters that can be produced only by pressing the Alt
key.
These guidelines should also be used for all service account passwords in the organization.
The following sections include the Password Policy recommendations for the three security
environments defined in this guide. These values are set at:
Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy
Enforce Password History
Domain Member
Default
Legacy Client
Enterprise Client
High Security Client
24 passwords
remembered
24 passwords
remembered
24 passwords
remembered
24 passwords
remembered
The
Enforce password history
setting determines the number of unique new passwords that have to be
associated with a user account before it is possible to reuse an old password. The value must be set
between 0 and 24 passwords. The default value for Windows Server 2003 is the maximum, 24
passwords. This policy setting enables administrators to enhance security by ensuring that old
passwords are not continually reused. To maintain the effectiveness of the password history, also
configure the
Minimum password age
to prevent passwords from being changed immediately. This
combination makes it difficult for users to reuse passwords, either accidentally or on purpose. Since
there are common vulnerabilities associated with reusing passwords, and specifying a low number for
this setting will allow users to continually recycle a small number of passwords repeatedly, this setting
recommendation is consistent across all environments defined within this guide. Also, there are no
known issues related to setting this value at the maximum number for environments containing legacy
clients.
Maximum Password Usage
Domain Member
Default
Legacy Client
Enterprise Client
High Security Client
42 days
42 days
42 days
42 days
The
Maximum password age
can be
set so that passwords expire as often as necessary. The default
values for this setting range from 1 to 999 days. This policy setting defines the period in which an
attacker who has cracked a password may use it to access a computer on the network before the
password expires. Changing passwords regularly is one way to prevent passwords from being
compromised. The default value for this setting is 42 days. Most passwords can be cracked given
enough time and computing power; the more frequently the password changes, the less time an
attacker has to crack a password before a new one is created to invalidate his efforts at cracking the
old password. However, the lower this value is set, the higher the potential for an increase in calls to
help desk support. In order to balance the needs of security and usability in corporate environments,
administrators can increase this setting in the Legacy Clients and Enterprise Clients. These
recommended values increase password security by ensuring passwords are cycled periodically. In
addition, the recommended values prevent users from having to change their password so often that
they cannot remember what it is.
