Improve company productivity with a Business Account.Sign Up

x
?
Solved

Active Directory: Customize the Password must meet complexity requirements

Posted on 2010-09-01
9
Medium Priority
?
2,206 Views
Last Modified: 2012-05-10
HI,

I am looking to customize the Password must meet complexity requirements option in AD 2003 and 2008.  

We need to take out the Non-alphabetic characters from this policy.  

does anyone know how I can change the DLL for the policy?  and do you have instruction?
0
Comment
Question by:SEHC
8 Comments
 
LVL 22

Expert Comment

by:Matt V
ID: 33578226
You change this in the group policy setting.  Usually in the default domain policy object.  Through group policy management console.
 
0
 
LVL 7

Expert Comment

by:simonseztech
ID: 33578233
You can configure the password policy settings in the following location in the Group Policy Object Editor:

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

If you’re on a stand-alone machine (no AD etc) and dealing with only local accounts, you can enable/disable the policy from:

Administrative Tools -> Local Security Policy -> Account Policies -> Password Policy.

Have a look at KB from microsoft
http://technet.microsoft.com/en-us/library/cc264456.aspx
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 1000 total points
ID: 33578537
So you won't just be able to take the non-alphabetic characters out.  You will have to disable password must meet complexity requirements (in the domain linked GPO that others have mentioned)
http://technet.microsoft.com/en-us/library/cc786468(WS.10).aspx 
Thanks
Mike
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
LVL 86

Assisted Solution

by:oBdA
oBdA earned 1000 total points
ID: 33578863
Unless you feel like writing your own passfilt.dll, you'll have to resort to 3rd-party tools like "Password Policy Enforcer" (http://www.anixis.com/products/ppe/default.htm) or "Specops Password Policy" (http://www.specopssoft.com/web/specops-password-policy.aspx).
0
 
LVL 4

Author Comment

by:SEHC
ID: 33579090
is there a way to write a passfitt.dll?  do you have and links I can look at?
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 33579129
If you want to attempt to do it yourself (if you have a strong programming backgorund) start here
http://msdn.microsoft.com/en-us/library/ms721882(VS.85).aspx
 I've personally never tried it.
Thanks
Mike
0
 
LVL 86

Expert Comment

by:oBdA
ID: 33579279
An example is here (requires free registration); should still work with W2k3:
Enforce Custom Password Policies in Windows
http://www.devx.com/security/Article/21522/0/page/1

But note especially the "Before you implement" section on page 2:
"Consider the following issues before you start coding your own Password Filters:
[...]
* Expect the unexpected. Because LSA loads password filters during start-up, if something goes wrong, your system may become inoperable or go into deadlock. To avoid this, develop and test your DLLs on machines that have at least two operating systems installed.
[...]

And if you're comparing DIY with prices for a 3rd-party tool, don't forget to take into account how much it costs if your AD comes to a grinding halt because of a malfunction in the filter (and who'll have to take all the blame for it).
0
 
LVL 27

Expert Comment

by:Pber
ID: 34532803
This question has been classified as abandoned and is being closed as part of the Cleanup Program.  See my comment at the end of the question for more details.
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Active Directory can easily get cluttered with unused service, user and computer accounts. In this article, I will show you the way I like to implement ADCleanup..
How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

595 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question