Password Length and Group Policy

[pachucos]

I was wondering if there is a way to make group policy force a min length of users passwords to more than 16 characters? I have it set to 14 right now but that is the highest that gp will allow. I want my users to use 16 or more characters in thier passwords. What I am really looking for is a update that would allow that.
thanks in advance.

 

[mrdenny]

Password length is a domain wide setting. It needs to be set via GPO on the domain.

Denny

--Anything is possible. All it takes is a little research. (Me)

 

[pachucos]

I know that but I want to force users to have at least a 16 character password. GP will only go as high as 14 characters.

 

[mrdenny]

ah I mis understood.

The highest that it can be set is 14.

http://www.microsoft.com/technet/security/topics/issues/w2kccadm/acctpol/w2kadm07.mspx

Any reason that you want it higher than that?

Denny

--Anything is possible. All it takes is a little research. (Me)

 

[pachucos]

thanks,
the reasoning is due to the lanman hash. it is 7 characters hash. and if you have a 13 character password. it gets broken up as two 7 characters hashs. so if I made them use 16 characters the has wouldnt be broken up. just a thought.

 

[mrdenny]

If you set the encryption level above that level it won't store the passwords in the LANMAN hash. At the moment I can't remember where the setting it. Passwords that are forced to be that long will be very hard for users to remember.

Data shows that it is easiest for people to remember 7 digit strings. Hence the 7 digit phone number in the U.S.

Denny

--Anything is possible. All it takes is a little research. (Me)

 

[mlichstein]

AD supports passwords up to 128 characters (I think, it may be 256), but the GUI has the 14 character limit, due the lanman hash mentioned above.

 

[pachucos]

I have users that can't remember 4 digit passwords. I try to make them remember passpharases. it makes it kinda easier. and that is also why i wnat 16 characters so the lanman hash won't be stored.