User passwords and updates
Your second hypothesis is almost correct:
B) no password is required when the account is created but if the
password is changed it must still follow password policies.
For this to make sense, please understand that updating a user account password can be accomplished through two seemingly similar, but very distinct operations:
- By setting the password
- This is done by an administrative user
- Typically a permission delegated to helpdesk personnel
- Must adhere to
- Not bound by Password History policy settings
- By changing the password
- This is done by the user
- Typically a part of first authentication attempt after password expiration
- Must comply with Password Policy and
This means, that an Administrator can set your password to
null if your account object permits it (ie.
PASSWD_NOTREQD is set), regardless of the Password Policy that applies and how long it requires passwords to be.
You cannot change your password to
null however, as the "Password Change" implies that you are replacing a password, not unsetting it. Upon changing the password, the new password will be validated against the effective Password Policy.
I think the easiest way to remember, is that Password Policies apply to Passwords -
PASSWD_NOTREQD on the other hand, is a measure of whether you are allowed to not have a password - in which case the policy is no longer relevant.
Is it dangerous?
PASSWORD_NOTREQD might seem like a dangerous flag, but it's not in itself harmful as a lot of mechanisms prevents the usage of
null-passwords (or "blank passwords"). As noted above, users cannot unset their own AD user passwords by default, and Windows (consumer and Server editions alike) will reject password authentication over the network, for users with blank passwords, by default - that means you can only log on from the console.