password policies

[mattisontara]

I am interested in finding out what the standards (if any) are in companies in terms of their password changing policies, as well as what type of authentication your apps connecting to sql server use, what kinds of authentication the services run under, etc.
My company is in the process of coming up with a standard, but I dont have anything to compare it to. Any info would be appreciated.

 

[SQLBill]

to access our SQL Server, we require a twelve (12) character password with a combination of upper/lower case letters, numbers, and special characters. The password is good for 60 days and the new password cannot match any of the last five passwords used by the user.

all users must connect their app to SQL Server using their login and password.

-SQLBill

 

[mattisontara]

Ok, but here is a scenario... You have MSSQLServer service running under some domain account and that domain account gets changed by your network guys... do they tell you about it first? Do you even have the service running under a domain account? It has to doesn't it?

 

[tlbroadbent]

When the SQL Admin account password is changed, manual intervention is required to change the service startup parameters. If the network admins change the SQL Account password without notifying the Database admins or changing the start parameters themselves, SQL Server will not start the next time a start request is made.

Our policy requires that NT domain, mainframe and some application login passwords be changed every 90 days. Minimum password length is 6 characters. These policies can be enforced by the service or application.

When using SQL Authentication SQL Server doesn't have a mechanism to force password changes, ensure minimum password length, prohibit reuse of passwords, etc. If you use only NT authentication, policies can be easily established. Not so with SQL Authentication.

We use mostly SQL Authentication in our applications. We don't require users to login to SQL Server individually. If necessary, applications validate users and then the application uses its SQL login to access the data. Thus we have several application logins. The passwords are controlled and changed by the DBAs using our own proprietary methodology. Terry L. Broadbent - DBA
Computing Links:

http://tlbroadbent.home.attbi.com/prog.htm

faq183-874 contains "Suggestions for Getting Quick and Appropriate Answers" to your questions.