I work in a regulated industry where the default password complexity requirements provided with Windows don't meet our regulatory requirements. I've been using Anixis Password Policy Enforcer for several years to build complex password requirements on Windows Active Directory domains, and it includes excluding dictionary lists.

Limiting factor: It doesn't work for local accounts or stand-alone systems, only AD domain accounts.

Thank you,

Lyonell D. Keplar
Senior Systems Administrator
Western Electricity Coordinating Council
work 360.713.9042 | cell 503.807.4805
lkeplar (at) wecc (dot) biz [email concealed]

This email and any attachments may contain information that is privileged, confidential, or subject to copyright.  This email is intended solely for the use of the person or persons to whom it is addressed. Any dissemination, distribution, or copying of this communication in violation of any privilege, confidentiality or copyright requirements is strictly prohibited. If you receive this email in error, please notify the sender immediately by reply email or phone (360.713.9042) and permanently delete the original, any copy of this email, and any printout.

-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]] On Behalf Of Alberto Medina
Sent: Thursday, September 30, 2010 10:18 AM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Cc: 'Alberto Medina'
Subject: Prevent users to use specifics words in Passwords

Hi all,
I'd like to know how to prevent users from use specifics words in their password in Windows Server 2003. In the company users are required to change their password every 45 days, but some users use some words related to the company or the business, there's a way to prevent this in Windows Server 2003? Some kind of dictionary for words that can't be use?

Thank you and best regards,
Alberto Medina

[ reply ]