AD DS - Password Policies

Password Policies

Establish password policies based on organizational needs

Ensure users cannot select simple password or reuse passwords

When securing your user accounts use the Password Policy settings. You should configure the properties of the passwords that users might select. Use these settings to make sure users don’t select simple passwords, or passwords that have been recently used. You can only have one standard password policy in a domain.

Setting	Description	Values
Enforce password history	The number of unique, new passwords that must be associated with a user account before an old password can be reused.	Default setting: 24 passwords
Maximum password age	Number of days that a password can be used before the user must change it.	Recommended setting: 42 days
Minimum password age	Number of days that a password must be used before the user can change it.	Default setting: 1 day
Minimum password length	Minimum number of characters that a user’s password must contain.	Default setting: 7 characters High security: 15 characters
Complexity requirements	Required password characteristics. Don't disable.	Does not contain your name or user name. Has at least six characters. Contains characters from different charsets

Contains characters from 3 of these 4 for charsets:  Uppercase letters [A–Z]; Lowercase letters [a–z]; Numerals [0–9]; Special, non-alphanumeric characters, such as !@#)(*&^%