Password must meet complexity requirements active directory

Overview#

Passwords Must Meet Complexity Requirements is a "Phrase" used in Microsoft Active Directory to indicate the Password Quality or Password

Passwords Must Meet Complexity Requirements#

The default password filter Passfilt.dll included with Windows Server 2003 requires that a password:

• Is not based on the user’s account name.
• Contains at least six characters. Password Minimum Length
• Contains characters from three of the following four categories:
  • Uppercase alphabet characters (A–Z)
  • Lowercase alphabet characters (a–z)
  • Arabic numerals (0–9)
  • Nonalphanumeric characters (for example, !$#,%)

As stated above, this policy is NOT enabled by default. This policy is enabled by activating the "Passwords Must Meet Complexity Requirements" in the GPO for the domain and can be determined from LDAP by Evaluating values of the pwdProperties Attribute.

More Information#

There might be more information for this subject on one of the following:

• Passfilt.dll
• Windows Default Password Policy

Password policies in Active Directory help administrators enable password complexity requirements like Minimum password length and Password must meet complexity requirements that force users to create secure passwords. Active Directory password policies can be implemented using two methods:

1. Group Policy Objects (GPOs)
2. Fine-grained Password Policy (FGPPs)

With GPOs, a password policy is applied only if it is configured in a group policy that is linked to a domain. A group policy with a password policy configured can be linked to an Organizational Unit (OU), but the password policy will not apply for users under that OU. In short, a GPO password policy can only be applied to all the users in a domain and not to users in OUs. If multiple password policies are required, multiple domains need to be be created for the policies.

FGPPs, as the name suggests, can be used to create multiple, fine-grained password policies within a domain. Here, password settings are configured in a Password Settings Container that can be applied to users and groups in the domain. Once again, FGPPs cannot be applied for OUs.

Along with these limitations, there are other disadvantages to creating password policies in Active Directory:

Disadvantages of Active Directory password policies:

• The complexity requirements under the Password must meet the complexity requirements option are predetermined and non-customizable.
• Specific patterns and words cannot be restricted from use.
• Password history cannot be enforced for password resets by administrators using the Active Directory Users and Computers console.
• Character repetitions cannot be restricted.

ADSelfService Plus, an Active Directory self-service password management and single sign-on solution, offers the Password Policy Enforcer feature. This feature offers password complexity requirements that overcome the disadvantages described above and introduce many other rules to enforce the creation of strong and complex domain passwords that are immune to hacks.

Some of the major advantages offered by ADSelfService Plus's Password Policy Enforcer are:

• Creation of multiple password policies that can be applied to the domains, groups, and OUs of the organization's choice.
• A display of the password complexity requirements during password changes or resets.
• Rules to force the usage of a minimum number of characters belonging to any or all these types: uppercase alphabets, lowercase alphabets, special characters, numeric characters, and Unicode characters
• Rules to restrict the use of specific patterns and words, and palindromes.
• Rules to restrict the use of consecutive characters from username or old passwords.

Apart from the Password Policy Enforcer, ADSelfService Plus also offers features like:

• Self-service password reset and account unlock for Active Directory accounts.
• Enterprise single-sign on and password synchronization.
• Multi-factor authentication during self-service actions, and Windows, macOS, and Linux logins.
• Password and account expiration notifications.

Learn more about ADSelfService Plus and Password Policy Enforcer

Create stringent policies to enforce secure passwords.

Thanks!

Your download is in progress and it will be completed in just a few seconds!
If you face any issues, download manually here

Self-service password management and single sign-on solution

ManageEngine ADSelfService Plus is an integrated self-service password management and single sign-on solution for Active Directory and cloud apps. Ensure endpoint security with stringent authentication controls including biometrics and advanced password policy controls.

• 
  Free Download
• Know more

• Related Products
  • ADManager Plus Active Directory Management & Reporting
  • ADAudit Plus Real-time Active Directory Auditing and UBA
  • EventLog Analyzer Real-time Log Analysis & Reporting
  • AD360 Integrated Identity & Access Management
  • Log360 Comprehensive SIEM and UEBA
  • AD Free Tools Active Directory FREE Tools

How do you fix the password does not meet the Password Policy requirements?

What does password does not meet complexity requirements mean?