 |
 |
One thing that I would recommend that I am not seeing is setting a minimum password age to be in the 1-2 week range. If you don't do this, you will get users who keep changing passwords until they cycle through the password history and arrive back to the same one, even with a one day delay. Personally, I find a minimum password length in the 7-8 character range (with complexity requirements) to be more than enough to cover yourself from a brute force attack, as even with current GPU hashing its going to be measured in months to years. The far more likely scenario, the one that we've seen dozens of times in the last year, is users registering website accounts to their work email address and using the same password on both account. Your AD is going to salt and hash your passwords properly, but external websites are a complete unknown and *they keep doing it wrong* and you find dumps of email/password combos all over pastebin. Setting a password expiration policy helps get using users out of using the same password for everything, starting with their work account. This idea of having a "favorite password" is terrifying from an exposure as more often than not everything is registered and authenticated by the same email address. A single endpoint entrusted with that credential set getting compromised opens the floodgates in that situation. And if your still running XP systems, don't forget to disable LanManager hashes in your policy and force a change to purge them out.