Re: Reasons and examples for security

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 12/12/04 

Date: Sun, 12 Dec 2004 17:56:51 GMT

It is standard operating procedure that users have access to only their home
folders. As far as password policy I would use the Microsoft document called
"Threats and Countermeasures" to help build your case. --- Steve

http://www.microsoft.com/technet/security/topics/hardsys/tcg/tcgch00.mspx --
Threats and Countermeasures guide with example pasted below

Maximum password age

The Maximum password age setting determines the number of days that a
password

can be used before the system requires the user to change it.

The possible values for this Group Policy setting are:

. A user specified number in days between 0 and 999

. Not Defined

Vulnerability

Any password can be cracked. With current computing power, breaking even the
most

complex password is only a matter of time and processing power. Some of the
following

settings can increase the difficulty level of breaking passwords in a
reasonable amount of

time. However, frequently changing user passwords in your environment may
help

reduce the risk of a valid password being cracked, as well as mitigating the
risk of

someone using a password that has been wrongfully acquired. The maximum
password

age can be configured so that users are never required to change their
passwords, but

doing so will result in a major security risk.

8

Countermeasure

Set Maximum password age to a value between 30 and 60 days. The value for
the

Maximum Password Age setting can be configured to never expire by setting
the number

of days to 0.

Potential Impact

Setting the Maximum password age value too low will require users to change
their

passwords very often. This may actually reduce the security in the
organization because

it may increase the possibility of users writing their passwords down to
avoid forgetting

them. Setting the value too high will reduce the level of security within an
organization

because it will allow a potential attacker a much larger timeframe in which
to crack a

user's password.

"roshak31" <Roshak31@news.postalias> wrote in message
news:71471564-180B-43B4-944A-B8FA41EB7E34@microsoft.com...
>I am looking for examples to support my case for tighter security. I am
> looking in the area of having to renew passwords at set time period which
> is
> not currently being done. I am also looking to find any supporting
> arguments
> for not having all home folders of everyone on the network available to
> everyone else on the network.
>
> Any stories and or arguments that would help my case for stronger security
> would be appreciated.
>
> Thanks,

Relevant Pages

  • Re: Implementing strong password policy
    ... The AD domain was created using Windows 2000 DCs originally and then upgraded to 2003. ... When you say that there has never been an enforcement of the password policy, did they disable the built-in password policy? ... To circumvent that, you set the maximum password age to some pretty high value, let's say 300, to catch the first batch of "old password" people and let them change their passwords. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Enforce "Password Never Expires" Setting?
    ... This feature allows you to configure a different password policy to a user or group. ... So in your case, you would have to create a shadow group, add all your service accounts to the shadow group, create a PSO that sets the maximum password age to 0, and apply the PSO to the shadow group that you created. ... logoff script would seem moot since the service account never actually logs ...
    (microsoft.public.windows.group_policy)
  • Re: Change password
    ... You could set the maximum password age setting. ... If you set it to 30 days, as long as everyones password is greater than 30 ... > At this moment we have a domain with 300 users, no> password policy set so far, .Now we need to set a> password policy > ...
    (microsoft.public.win2000.active_directory)
  • Re: Simple Password Question for 2003
    ... make these changes in Administration tools\Local security policy\Account ... policies\Password policy. ... meet complexity requirements" and setting "Maximum password age" to 0. ...
    (microsoft.public.windows.server.setup)
  • RE: Passwords
    ... there is a folder called Password Policy. ... > Change the Maximum password age to what you desire. ...
    (microsoft.public.windowsxp.general)