Default Password Policy Win Server 2008
Posted on | May 15, 2011 | Comments Off on Default Password Policy Win Server 2008
Changing Server 2008 Password Policy
I have been having some fun working on a couple of Windows Server 2008 R2 installations. Learning a lot of new things every day and this is something that I thought might be of interest.
In one installation the folks that were paying the bill did not like the default password policies that are now standard in windows server. They felt that in their small and close environment there was no real need for the stricter requirements being enforced by the new default policies. There were actually pretty lax in their password demands.
I did not and still do not agree with them but upon their insistence I had to figure out how to bypass this need for stronger passwords.
As a quick reminder Microsoft Server 2008 r2 now insists that your password meet certain ‘complexity’ requirements. This is a good thing – as long as you can remember your password and don’t write it somewhere obvious. Briefly:
Account Policies/Password Policy
Policy :: Settings
- Enforce Password history :: 24 passwords remembered
- Maximum password age :: 42 days
- Minimum password age :: 1 day
- Minimum password length :: 7 characters
- Password must meet complexity requirements :: Enabled
- Store passwords using reversible encryption :: Disabled
Some of these settings can be adjusted at the user level in Active Directory Users and Computers. Modifying or shutting off the Complexity policy requirement in not accessible there.
Here is an explanation of the password complexity requirement option.
Password must meet complexity requirements
This security setting determines whether passwords must meet complexity requirements.
If this policy is enabled, passwords must meet the following minimum requirements:
Not contain the user’s account name or parts of the user’s full name that exceed two consecutive characters
Be at least six characters in length
Contain characters from three of the following four categories:
English uppercase characters (A through Z)
English lowercase characters (a through z)
Base 10 digits (0 through 9)
Non-alphabetic characters (for example, !, $, #, %)
Complexity requirements are enforced when passwords are changed or created.Default:
Enabled on domain controllers.
Disabled on stand-alone servers.Note: By default, member computers follow the configuration of their domain controllers.
There are probably several ways of working around this – but I chose the simple (not always the best no matter what anyone says) way. Please don’t laugh. I thought this was simple…
- Open Group Policy Management Editor
- Start->Run->gpme.msc
- New Window – Browse for a Group Policy Object
- Under the Domains/OUs tab select Default Domain Policy -> OK
- New Window – Group Policy Management Editor
- Default Domain Policy [servername.domain.extension]
- Expand Computer Configuration
- Expand Policies
- Expand Windows Settings
- Expand Security Settings
- Expand Account Policies
- Select Password Policy
- Now in the right pane :
- Right Click “Password must meet complexity requirements Enabled”
- Select Properties
- New Window – Select Security Policy Setting tab
- Select Disabled->OK
There is probably an easier, faster, or better way to do this. Let me know.
Thanks,
ken