Changes you should make to password policy default settings

This checklist was updated on Nov. 2, 2004.

I used to hate talking about sensitive subjects, making myself a target. But I just can't ignore the awful truth any longer. Most of corporate America wants to blame its employees for the lack of network security. According to these organizations and some security gurus who should know better, users are hell bent on writing their passwords on sticky notes, clicking on attachments that say, "Click me, your mine!" and handing their laptops to vagabonds along their travels.

People who blame users should recall the idiom about those who live in glass houses -- they shouldn't be throwing stones. Case in point: How many of you have weak password policies or offer little help to users trying to create strong passwords that can be easily remembered? Are you squirming yet? Instead of blaming the user, there are three things that you -- those who set up and support security policy -- must do.

• Implement Windows technical controls.
• Write a strong authentication policy and include the consequences of not following it.
• Provide user training and assistance on your password policy requirements, and reward them for compliance.

While any good password policy should be written independent of the available operating system controls, I'm going to focus this checklist on my first point and detail controls to set in Windows based on what's available. The other two points I'll leave for another day.

If you have implemented Windows Server 2003, some good defaults are already in place. Prior to Windows Server 2003, the default password policy was useless. If you're still using it -- stop. For instance, in Windows XP and Windows 2000, no password history is kept; users can reuse passwords again and again; passwords can immediately be changed, even back to the original password; there is no minimum password length; a blank password is allowable; and no complexity requirements are set (even the user id can be a password).

Regardless of your Windows domain operating system, here's a list of recommended settings to strengthen your password policy technical controls.

You may download a printer-friendly version.

Checklist: Changes you should make to password policy default settings

Increase password history

Control: Enforce password history Windows 2000 default: 0 passwords remembered

Windows Server 2003 default: 24 passwords remembered Recommendation: 26 passwords remembered

Maintain default maximum password age

Control: Maximum password age Windows 2000 default: 42 days

Windows Server 2003 default: 42 days Recommendation: 42 days

Increase minimum password age

Control: Minimum password age Windows 2000 default: 0 days

Windows Server 2003 default: 1 day Recommendation: 5 days

Increase minimum password length

Control: Minimum password length Windows 2000 default: 0 characters

Windows Server 2003 default: 7 characters Recommendation: 15 characters

Enable complexity requirements

Control: Password must meet complexity requirements Windows 2000 default: Disabled

Windows Server 2003 default: Enabled Recommendation: Enabled

Enable reversible encryption

Control: Store passwords using reversible encryption Windows 2000 default: Disabled

Windows Server 2003 default: Disabled Recommendation: Disabled

Click here to read Roberta's Ask the Expert response about enabling complex passwords.

ABOUT THE AUTHOR:   Go back

Roberta Bragg is author of "Hardening Windows systems" and a SearchWindowsSecurity.com resident expert. She is an MCSE, CISSP and Microsoft MVP, and a well-known information systems security consultant, columnist and speaker. Click to ask Roberta a question or purchase her book here. Also, if you have specific questions or comments about any of Roberta's checklists, click to e-mail her directly. Copyright 2004

Rate this Tip To rate tips, you must be a member of SearchWindowsServer.com. Register now to start rating these tips. Log in if you are already a member. Digg This!     StumbleUpon     Del.icio.us    RELATED CONTENT Microsoft Windows Server 2003 Administration How to install Windows Server 2003 patches when offline Validating Windows server clusters with ClusPrep Exploring the Windows Server 2003 Resource Kit: Clusfileport.dll Exploring the Windows Server 2003 Resource Kit: Cmdhere.inf and CMGetCer.inf Windows server security management: Security expert roundup Windows server management with Remote Desktop Avoid DC restoration problems with authoritative restore Exploring the Windows Server 2003 Resource Kit: Confdisk.exe Exploring the Windows Server 2003 Resource Kit: Compress.exe and Expand.exe Exploring the Windows Server 2003 Resource Kit: Clusterrecovery.exe Microsoft Windows Server 2003 Administration Research RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.