Bear in mind that the more restrictive your policy, the more times you'll be called upon by users who need accounts unlocked, or passwords reset. The less restrictive your policy, the more risk you expose your organisation to.
By default, you can not define how complex a domain password policy is (up to 2003 at least). There are ways and means of changing the rules, but from my understanding it's exceptionally convoluted, and not for the feint of heart. In other words, you can not decide you want your users passwords to be 3 caps, 2 special, 2 numeric etc.
Here's what will be set when you Enable the Password must meet complexity requirements setting in the Default Domain group policy:
Password must meet complexity requirements.
This security setting determines whether passwords must meet complexity requirements.
If this policy is enabled, passwords must meet the following minimum requirements:
Not contain the user's account name or parts of the user's full name that exceed two consecutive characters Be at least six characters in length
Contain characters from three of the following four categories:
English uppercase characters (A through Z)
English lowercase characters (a> through z)
Base 10 digits (0 through> 9)
Non-alphabetic characters (for> example, !, $, #, %)
Complexity requirements are enforced when passwords are changed or created.
What you can set however, is:
- minimum password length
- minimum password age
- maximum password age
- password history
- account lockout threshold (invalid login attempts)
- account lockout duration
Across all our domains we use complexity, 8 character minimum, 14 day minimum age, 90 day maximum age, 14 password history, 5 invalid login attempts, 30 min lockout duration