Questions tagged [password-policy]
The password-policy tag has no usage guidance.
76
questions
9
votes
1
answer
11k
views
Does the password truly expire?
One can enable password expiration (aka password maximum age) on a Windows domain.
I'm a little puzzled though about the meaning of that so-called expiration: It looks like the password does not ...
- 419
7
votes
1
answer
774
views
How do I implement a Fine-grained password policy and expect XP machines to play nice?
I have a 2008 R2 functional level domain and am in the middle of implementing the first actual password policy my organization is going to use.
To slowly roll this out to our users, we have chosen to ...
- 331
5
votes
2
answers
822
views
How long does a PuTTY keyphrase need to be (i.e. how does PuTTY encrypt private keys)
I'd like to know what a good minimum password length for a PuTTY passphrase is. This depends on the amount of entropy the passphrase needs to have, which in turn depends on the length one attempt ...
- 326
5
votes
3
answers
2k
views
Block RSA authentication when password is expired
I'm setting up a FreeIPA server on CentOS 7, and I want to block RSA authentication over SSH when the password is expired. By default, when I expire the user password and they login, they are forced ...
- 51
5
votes
3
answers
45k
views
Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain
I'm using federated identity for Office-365 single sign-on. I have added the password change endpoint to my ADFS 3.0 server, and successfully opened the adfs update password page. However, whenever I ...
- 131
4
votes
3
answers
4k
views
How does "your new password must differ at least n characters from the previous" work when only hash codes are stored?
I am wondering how the password policy "your new password must differ at least n characters from your old password" works.
My understanding is that the OS never actually stores the old passwords ...
- 210
4
votes
3
answers
17k
views
Enforce 15-character minimum password length on Windows
I've been given a requirement to enforce a minimum password length of 15 characters on my Windows-based systems. Supposedly, this is possible and is being done on some other systems already. However, ...
- 2,466
4
votes
1
answer
8k
views
How to change Windows Server 2012 password requirements when installing?
i'm trying to install Windows Server 2012, and i'm being prompted that the Administrator account password does not meet the password security requirements:
The password you typed does not meet the ...
- 5,373
4
votes
1
answer
561
views
Apply New Password Policy via GPO Gradually
I want to make changes to the password policy in our domain (for example, include password complexity) but I want to apply it gradually, to some OU's or users group first. As far as I know the ...
- 299
4
votes
1
answer
7k
views
The password on this account cannot be changed at this time?
A user in my company forgot his password and I had to reset it to a temporary one. I checked the box that says "User Must Change Password at Next Logon".
When he logged on and entered the temporary ...
- 7,059
4
votes
2
answers
6k
views
Workstations hang on "Change Password" after expired Password
For one of our customers we have configered a maximum password age of 90 days. If those 90 days are over, the users are forced on logon to change their password. This worked fine for the past 9 months,...
- 83
3
votes
1
answer
12k
views
OpenLDAP: pwdChangedTime attribute isn't created after changing the password?
I'm going to integrate the check_mk's Multisite with OpenLDAP. After configuring the LDAP connector, I get the following error when opening the "Users & Contacts" page:
Error executing sync hook
...
- 51.8k
3
votes
2
answers
871
views
Is it possible to limit the number of user account password resets per day in Active Directory?
Windows domain environment here. We're looking at putting in a self-service password reset system (using Citrix Single Sign-on), and I'm trying to figure out if we can limit the number of password ...
- 275
3
votes
1
answer
140
views
How convince Security auditors to change frequent password change policy?
I am a new Junior IT Manager in a small company of around 500 employees and the current policy regarding passwords has enforced password expiration within 30 days, with a password history of 5.
As ...
- 33
3
votes
2
answers
698
views
Changing Windows password policy [closed]
We currently have the almost defacto standard of requiring complex passwords on our Windows AD domain. But this XKCD cartoon caught my eye a few months ago when it came up on Coding Horror (I think):
...
- 1,717
3
votes
5
answers
19k
views
Apply a password group policy seperate from the Default Domain Policy?
Im trying to keep my Default Domain Policy clean and standard and I want to make a GPO for my password policies.
I made it but it still gets the policies from the Default Domain Policy object.
I ...
- 515
3
votes
1
answer
1k
views
Forcing a password change on OpenBSD
On OpenBSD 5.6 I need to provision a number of user accounts with default passwords. I would like users, upon their first SSH login, to be forced to change their passwords from the default.
On CentOS ...
- 131
3
votes
1
answer
12k
views
Get password policy information from LDAP Server
Is there a way to get the password policy information (password length, complexity etc) of a user from an OpenLDAP server? (with ldapsearch or some other way).
- 447
3
votes
1
answer
496
views
Samba, password change and windows error messages
I moved password quality checking in Samba from check password script to PAM, now when pam_passwdqc or pam_cracklib deny password change the user revives a "Access denied" error, not the standard "The ...
- 6,401
3
votes
1
answer
382
views
Issue with Mac RDP clients connecting to Server 2008 if change password at next logon checked
I have a weird issue I haven't been able to figure out (primarily because I don't have a Mac to play with). When a user is connecting into our Windows Server 2008 and 2008 R2 servers with local user ...
- 151
2
votes
2
answers
4k
views
How to use PAM to manage lockout policy for ssh public key authentication methods
I have followed instructions on redhat on how to harden authentication on a linux server, but we only use SSH with public key auth. According to these instructions:
https://access.redhat.com/...
- 174
2
votes
1
answer
6k
views
Setting fine-grained password policy on an OU - Windows Server 2008
I found this article: AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide really useful to set fine-grained password policies for a user or a Security Group.
But I haven't found ...
- 1,128
2
votes
1
answer
12k
views
Find current password complexity requirements on domain
I simply need to know what my network's password complexity requirements are at this time. I believe we had competing group policies in place (trying to clean up that mess) and I want to see which ...
- 373
2
votes
1
answer
1k
views
OpenLDAP password policy for a group
Just wondering if OpenLDAP is able to assign a password policy to a specific group? Thanks
- 23
2
votes
2
answers
1k
views
How can I randomize or stagger password expiration through Active Directory?
We are about to implement a new password policy that will require users to change their password every six months. We also need every user to change their password this week. I'd rather not create a ...
- 894
2
votes
1
answer
2k
views
Changing domain password on DC fails regardless of complexity
I have a new Windows 2008 R2 Server (Standard, German). After installation from CD I enabled RDP Access, installed the Active Directory services and executed dcpromo. After reboot I log in via RDP as ...
- 392
2
votes
2
answers
2k
views
Force user to change AD password at logon before Explorer loads?
Background:
In our environment, users log onto a Windows 7 PC and then launch a full-screen Citrix XenApp (same as Microsoft RDSH) desktop. Citrix Reciever with single-sign on is used to launch the ...
- 51
2
votes
1
answer
1k
views
Reversible Encryption - Not Defined but Showing as Enabled?
I'm reviewing our complex password policy that was setup by a previous admin and I'm trying to gain some clarification on the setting for Reversible Encryption. In our organization, reversible ...
- 23
2
votes
3
answers
8k
views
User unable to change password - Active Directory Group Policy
I've seen this issue come up, but no answers seem to be applicable.
When a user tries to change their password using control-alt-delete -> change password, they're getting a "Unable to update the ...
- 21
2
votes
1
answer
8k
views
Openldap setting up olcOverlay: ppolicy
Question: Why am I failing to add the objectclass pwdPolicy to cn=PasswordDefaults?
Background Information
I am new to LDAP and I'm stumbling through various tutorials and other tips online to ...
- 65
2
votes
1
answer
1k
views
GPO Password Policy Only Partially Applied
We are trying to modify our existing password policy that is being applied via GPO. For some reason it is not applying any of the settings in the password policy section (Comp Config > Policies > ...
- 273
2
votes
1
answer
2k
views
how to set pwdMaxAge for a single user in OpenLdap
If I do this, it is applicable to all users.
ldapadd -v -H "ldaps://hostName/" -x -W -D cn=admin,dc=mydomain,dc=com -f pwdMaxAge.ldif
dn: cn=passwordDefault,ou=Policies,dc=mydomain,dc=com
...
- 33
2
votes
0
answers
153
views
Windows Domain Password Policy Issue
I just discovered something odd happening with a password policy in one of the Windows Server 2012 R2 environments we manage, and we have had no luck finding any information to explain the behavior.
...
- 201
1
vote
4
answers
2k
views
Do password expiry rules reducing the security of the system?
The problem
I regularly have a debate with my CTO which usually begins something like this ...
CTO: My password expired, that should never happen.
Me : It's a security risk to never expire ...
- 113
1
vote
2
answers
1k
views
If user passwords are set to automatically expire within a Windows domain, does this have an impact on the force password change checkbox within ADUC?
Assume the following:
A Windows domain has a policy set to ensure that users must reset their passwords every 90 days
A user account (let's refer to it as "UserA") last changed their ...
- 165
1
vote
1
answer
2k
views
Sudo: cannot setup user to avoid being asked for password
I run:
sudo visudo
and set this line for my user
myuser ALL=(ALL) NOPASSWD: ALL
however, I am still asked a password when I run a sudo command
how can I setup the user so that the password ...
- 367
1
vote
2
answers
2k
views
ppolicy with pam_ldap - pwdReset has no effect when logging in from Ubuntu
We installed ppolicy overlay on our ldap server. Password policies work correctly for locking out user after X incorrect password attempts, but we can't enforce user to change his password.
When we ...
- 121
1
vote
2
answers
2k
views
Password history in Active Directory
We are considering enabling "Enforce password history" on our Active Directory, the password is now maintained by another IAM system, but we are looking into changing it to AD/AAD.
Users has ...
- 111
1
vote
1
answer
82
views
How to increase time for password-protected screensaver
I run a network with server 2012 r2, I have users in active directory.
The computers lock after 5 minutes of inactivity. Is there any way to extend the time to 1 hour?
1
vote
1
answer
1k
views
Cannot enforce password change in OpenLDAP with Password Policy Overlay
I've implemented Password Policy Overlay on OpenLDAP on Debian Stable. The server side and the policies are working as expected. However, after expiration I cannot force users to change their ...
- 694
1
vote
1
answer
2k
views
Changing Password expiry date for limited users in Domain
I have 50 users in my domain. But i have to set password expiry days for 90 for only 10 users. How can i do it. How can this be done without affecting any other users Password Policy.
- 13
1
vote
1
answer
2k
views
Why isn't pwdReset automatically set when pwdMustChange is true?
Every other directory server, i.e. Oracle's will automatically set pwdReset to TRUE if pwdMustChange is defined in the policy:
When a user's password is changed by another user, such as a password ...
- 11
1
vote
1
answer
577
views
OpenLDAP pwdPolicySubentry for organizationalUnit
Can you set a pwdPolicySubentry for an organizationalUnit, so that all entries contained in that organizationalUnit follow that password policy?
- 171
1
vote
0
answers
447
views
PAM module configuration, ssh failure in Debian
I want to set password policies for users on a Debian VM, like minlen and special char required for the password.
In my Debian VM I get an error and can´t log in again via SSH to that machine.
OS ...
- 11
1
vote
1
answer
71
views
Give user's directory access to another user
Users are sharing their password. As you know, this is bad! The big reason why they do that is to allow a colleague to access theirs files when they are away. Yes, they can plan this in advance, but ...
- 481
1
vote
1
answer
767
views
ldap ppolicy implementation for brute force prevention
I have an openldap server (with user passwords) open worldwide which I'm trying to secure.
Step 1 was to limit access to data to authenticated users via ACLs.
Step 2, to prevent brute force attacks, ...
- 223
0
votes
2
answers
139
views
Required strength for Admin/Windows passwords [closed]
We're trying to come up with a policy for required password-strength for Windows passwords on our domain. I was leaning towards a 10 character minimum with special characters and uppercase. We have a ...
- 141
0
votes
1
answer
594
views
bad password count in different sites
What happens if a user try wrong password in different DC (sites), how come the lockout occurs after meeting threshold bad pwd count?
Account lockout threshold value is 3
for eg
i have 3 sites - Site ...
0
votes
1
answer
507
views
Cannot find Passfilt.dll on 2008 DC
I am trying to locate the standard password filter program called passfilt.dll on my 2008 DC. I searched the whole C drive but I could not find it.
According to documentation, it should be in c:\...
- 11
0
votes
1
answer
2k
views
Why am I not seeing the user lockout message?
When I try to login 3 times with the wrong password (locally), instead of seeing user locked out message:
su - myuser
Account locked due to 3 failed logins
I see this:
[myuser@ip-10-10-2-53 ~]$ su -...
- 174