Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just had a user unable to change his password on a Windows 2008 domain. It was giving him a cryptic message about complexity requirements even though he was certain his chosen password was meeting them. I tested it myself and confirmed.

It seems his last password had been set too recently per a Microsoft-recommended default of something like 10 days if I recall.

He asked of me a very good question, which I couldn't answer: why would there be a minimum password age? How could this reasonably benefit security? He also pointed out that one might discover their password to be compromised within this 10 day period and not be able to change it!

Would there be any valid reason to enforce a minimum password age?

share|improve this question
add comment

2 Answers

up vote 8 down vote accepted

Firstly, a technical answer:

Configure the minimum password age to be more than 0 if you want Enforce password history to be effective. Without a minimum password age, users can cycle through passwords repeatedly until they get to an old favorite.

http://technet.microsoft.com/en-us/library/cc779758(v=ws.10).aspx (Server 2003) http://technet.microsoft.com/en-us/library/hh994570(v=ws.10).aspx (Server 2008 / Windows Vista Onwards)

So, that's a good reason for it not to be 0. Additionally, according to those articles:

Default

1 on domain controllers.

0 on stand-alone servers.

So, in other words, the default is the minimum you need to be able to enforce a password history.

Now, personally, I don't think there is a valid security reason to enforce minimum password ages but there could be some practical / human reasons. For example, you may restrict the number of password changes to cut down on the number of "Forgot my password" calls. I could see this being practical for high school students, perhaps.

Finally, it's worth bearing in mind that these limits do not apply to manual password resets from with Active Directory Users & Computers. So a user could always ask the Sysadmin for help if they really need to change their password.

share|improve this answer
    
Thank you for the very good summary! –  Kevin Mar 28 '13 at 12:25
add comment

The rationale behind minimum password age is to prevent users from reverting to their old password immediately after an enforced password change. This policy is best used together with "password history" policy (prevent users from re-using their last X number of previous passwords).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.