Standard Password Complexity Rules Just Don’t Cut It Anymore

Microsoft Active Directory has had password complexity requirements built-in for a long time. Most administrators are familiar with the standard settings. You can set a minimum length, and require complexity, which, in Microsoft’s eyes is that the password must contain at least three (3) of the following:

The problem with this is that you can have some terrible passwords that meet or exceed these requirements. Let’s say you work at a fictional financial institution named “Bank of Mordor” and set a minimum length of ten (10) characters and require complexity...you can still (and probably do!) have users that will create passwords such as:

Note that none of those have special characters...they aren’t required based on the standard complexity rules above. Even if your users remember their security awareness training and throw a special character (normally a “!”) on the end, it won’t help much. Many password lists will have variations on the above, and a brute force password cracker would break these within seconds.

So, what can be done? Unfortunately, there isn’t much available out of the box to combat this particular issue. Here are some suggestions:

Authored by: Jeremy Johnson, OSCP, CISSP