1

Is is possible to configure a required pre- and suffix that users need to use while changing their password in a Microsoft environment? If so how?

Let me explain where this comes from. In my company they require users to have a default pre- and suffix on their passwords. This raises the default strength of the passwords. Though currently the ability for users to change their passwords is switched off. Because otherwise users would probably not use the pre- and suffix.

If a user needs to change his/her password they need to contact the IT department and they will enter in the new password (not secure at all). I'm currently busy researching security issues and this is one of them.

Improve this question
5
  • Adding fixed junk to a password doesn't improve it at all. Consider what happens if you are guessing a password: You only need to find out the middle part.
    – vonbrand
    Mar 14, 2013 at 10:01
  • So, lets take that into an equation, if people know the pre and suffix it doesn't change much (that is true), but if they don't then they have a harder time finding out than when not used at all. It is another step adding to the complete security. What you are implying is, why use a virusscanner, consider what happens if an attack would use an undetected new virus..... Security is not about 1 thing that fixes everything, it is about adding layers of security.
    – s.lenders
    Mar 14, 2013 at 11:02
  • Note that some 80 to 95% of attacks are insiders, and for them this adds no security whatsoever. It will decrease security to prefix + 3 chars + suffix ("too much typing")...
    – vonbrand
    Mar 14, 2013 at 11:06
  • Does it even matter to the subject? The scenario that you are drawing is well covered in our security policies. Do you have anything related to the question?
    – s.lenders
    Mar 14, 2013 at 11:20
  • 1
    So everybody knows the prefix and suffix? This dramatically reduces security, not increases it.
    – Michael Hampton
    Mar 14, 2013 at 12:19

1 Answer 1

Reset to default
2

There isn't a way to do this through native AD tools, you'll have to build something else.

Building something actually isn't all that hard. We had to do something like that at my old job since we needed a system to synchronize passwords between Active Directory and three other password systems. We built an online portal where users could manage certain aspects of their campus identity, and password-change was one of them. Like you, we disabled the ability to change passwords because otherwise changes wouldn't get synched to the other three systems.

It'll take some secure engineering, no doubt. But if you have a web-service that validates that submitted passwords pass complexity rules, it can easily add any prefix/suffix needed to any password changes. It's more secure than your current system since password changes aren't proxied through a human, and you can hide the page behind AD authentication as a way to better verify submitted password-changes come from the actual person.

Improve this answer
2
  • That was my initial thought to. Luckily i don't have to program it, i only need to make suggestions for improvement. Ty
    – s.lenders
    Mar 14, 2013 at 11:38
  • It's possible to create a GINA (-XP) or password filter (Vista+) that could set requirements of passwords and also synchronize the password across multiple systems. It's not all that complicated, but also not well documented.
    – Chris S
    Mar 14, 2013 at 13:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .