- [Instructor] Passwords are among
the most common authentication mechanisms
and it's important to ensure that they are secure.
Administrators may use group policy objects
to securely configure passwords
to require good password practices by end users.
Some password requirements exist
to make sure that passwords are difficult to guess
and resistant to brute force guessing attacks.
The first of these requirements
is the password length requirement.
Best practice is that passwords
should be at least eight characters long,
although some organizations require even longer passwords.
The second requirement
that makes passwords difficult to guess
is the password complexity requirement
that requires passwords include
different types of characters such as uppercase letters,
lowercase letters, digits, and symbols.
Strong password management practices also realize
that sometimes passwords fall into the wrong hands
and users should be protected against an attacker
retaining long-term access to their accounts.
Best practices in this area include
mandatory password expiration policies
that force users to change their passwords periodically.
Some organizations require password changes every 90 days
while others do choose longer time periods.
Users sometimes attempt to bypass
these password change requirements
by changing their password when it expires
and then immediately changing it back to the previous value.
Password history and reuse requirements
prevent users from engaging in this practice
by keeping track of old passwords
and preventing their reuse.
Strong password practices also prevent
brute force password guessing attacks.
Organizations should have policies in place
that lock out accounts
after a specified number of incorrect login attempts.
They should also disable unused accounts.
Finally, many organizations provide
an automated password recovery service
that allows users to reset their passwords
using an alternate authentication process
such as answering security questions.
This approach relieves the burden on help desks
and other IT staff members
by allowing users a self-service option
for one of the most common IT requests.
Answering these requests quickly on a self-service basis
also improves user satisfaction
with IT service they receive.
Let's take a look at implementing
some of these password policies in a Windows GPO.
In the group policy management tool,
let's go ahead and create a new GPO called password policy
and then we'll edit that policy,
expanding the computer configuration policies folder
and Windows settings,
security settings,
and finally the account policies folder.
When I click on the password policy setting in this folder,
we see some of the relevant GPO settings
that we can configure.
Let's use these to go ahead and create
a strong password policy.
The first thing we'll do is set a minimum password length.
We want to define this policy setting
and we're going to choose an eight-character password
to implement best practice.
Once we've applied this setting,
no user will be able to have a password
of fewer than eight characters.
We'll also set a password history requirement
that remembers the last eight passwords
that a user has chosen
and a maximum password age of 90 days.
Windows then suggests that we also set
a minimum password age of 30 days
to prevent users from rapidly cycling through passwords
to defeat our password history requirement.
We'll go ahead and click OK to accept that setting.
Then we'll go ahead and enable
the password complexity policy.
Once we've enabled it,
we can also click on the explain tab
to read the details of what this setting means.
It basically says that passwords have to have
some basic requirements about uppercase characters,
lowercase characters, and the other complexity settings
that we've already discussed.
Let's go ahead now and take a look
at the account lockout policy
and we're going to go ahead and make sure
that if users try to guess a password
that their account is disabled
after a certain amount of time.
We're going to say that the threshold for triggering this
will be five invalid login attempts.
And when we do that,
Windows suggests some values for other settings,
an account lockout period of 30 minutes
and a reset on the incorrect password attempt clock
of 30 minutes.
We'll accept both of those
and apply those new settings.
That's all it takes to build a strong password policy GPO
for your Windows domain.