up vote 2 down vote favorite
share [g+] share [fb]

Our group recently implemented 14+ character passwords on our Windows domain in order for us to be compliant with our organizational security directives.

On password change, users are now receiving a password length warning saying:

The Password is longer than older versions of Windows; such as 
Windows 98 or Windows 95, can use.

Is there a way to disable this warning? Our support team is being inundated with users asking about this.

Our network uses Windows XP SP3 and Windows 7 client operating systems only. The AD domain is at functional level 2008. We have GPOs set so LAN manager hash vales are NOT stored and LAN manager authentication level is NTLMv2 only.

link|improve this question
100% accept rate
2  
Here's my entirely-unhelpful comment: Wow. Glad I don't work there. – mfinni Jan 26 '11 at 18:11
LOL! Yeah... feel my pain... – newmanth Jan 26 '11 at 18:15
2  
@mfinni: Lol. I tend to use 15-20 character passwords myself, and I had to give one to someone over the phone once. He kept thinking I was finished, and I had to keep saying, "No no, wait, there's more." When I actually did get finished, he said, "I hate you so much" and slammed down the phone. In my experience it's pointless: if you make the passwords longer than the user can remember, then they'll write it down somewhere. – Satanicpuppy Jan 26 '11 at 18:16
I have been subjecting all my minions to 14+ since 2007. Look up hash table based password recovery services. – UnisoftDesign Jan 26 '11 at 19:35
Seems the budget isn't a problem in your firm. Why dont implement card secure logins? We have done it and it's working really good. (50% of support was fired but hey! it works) – Carlos Feb 2 '11 at 17:27
feedback

2 Answers

up vote 1 down vote accepted

The only suggestion I can come up with is to hack the msgina.dll and replace the default error text with something else. Maybe something like, "Your password will be changed when you hit OK. You can press cancel to not have your password changed.

link|improve this answer
feedback
up vote 2 down vote

There is an option somewhere for compatibility with older versions of Windows -- I don't recall if it's an AD option or a something in group policy, but if you disable that you shouldn't get the warning anymore.

That being said, Satanicpuppy is 100% right: Any password longer than a user can remember will be found on a post-it note under their keyboard (if you're lucky -- otherwise it's going to be right on the monitor :-)

CW so some generous soul can edit and add details on where this option is - I haven't touched a Windows server environment in a long time :-)

link|improve this answer
Guess I can get some easy rep if I figure this out Monday – Justin Dearing Jan 29 '11 at 23:01
I looked everywhere and I can't find it. – murisonc Feb 1 '11 at 1:27
Yeah... I too had thought there was a group policy for this, and now I don't think there is. We've been looking... and looking... – newmanth Feb 2 '11 at 17:13
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.