Passwords

Passwords provide the first line of defense against unauthorized access to your domain and local computers.

  • For tips about using passwords, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Best practices

Create an extensive defense model.

  • Educate your users about how to best protect their accounts from unauthorized attacks. For more information, see Encourage your users to follow best practices for password protection.
  • Use the system key utility (Syskey) on computers throughout your network. The system key utility uses strong encryption techniques to secure account password information that is stored in the Security Accounts Manager (SAM) database.

    For more information about the system key utility, see The system key utility. For information about how to create or update a system key, see To create or update a system key.

  • Define password policy that ensures that every user is following the password guidelines that you decide are appropriate. For more information, see Define password policy so that all user accounts are protected with strong passwords.
  • Consider whether implementing account lockout policy is appropriate for your organization. For information about the risks involved in applying account lockout policy, see Be cautious when defining account lockout policy.

Encourage your users to follow best practices for password protection.

  • Always use strong passwords. For more information, see Strong passwords.
  • If passwords must be written down on a piece of paper, store the paper in a secure place and destroy it when it is no longer needed.
  • Never share passwords with anyone.
  • Use different passwords for all user accounts.
  • Change passwords immediately if they may have been compromised.
  • Be careful about where passwords are saved on computers. Some dialog boxes, such as those for remote access and other telephone connections, present an option to save or remember a password. Selecting this option poses a potential security threat.

Define password policy so that all user accounts are protected with strong passwords.

  • Define the Enforce password history policy setting so that several previous passwords are remembered. With this policy setting, users cannot use the same password when their password expires.
  • Define the Maximum password age policy setting so that passwords expire as often as necessary for your environment, typically, every 30 to 90 days. With this policy setting, if an attacker cracks a password, the attacker only has access to the network until the password expires.
  • Define the Minimum password age policy setting so that passwords cannot be changed until they are more than a certain number of days old. This policy setting works in combination with the Enforce password history policy setting. If a minimum password age is defined, users cannot repeatedly change their passwords to get around the Enforce password history policy setting and then use their original password. Users must wait the specified number of days to change their passwords.
  • Define a Minimum password length policy setting so that passwords must consist of at least a specified number of characters. Long passwords—seven or more characters—are usually stronger than short ones. With this policy setting, users cannot use blank passwords, and they have to create passwords that are a certain number of characters long.
  • Enable the Password must meet complexity requirements policy setting. This policy setting checks all new passwords to ensure that they meet basic strong password requirements. For a full list of these requirements, see Password must meet complexity requirements.
  • For information about how to apply or modify these policy settings, see To apply or modify password policy. For information about each of these policy settings, see Password Policy.

Be cautious when defining account lockout policy.

  • Account lockout policy should not be applied haphazardly. While you increase the probability of thwarting an unauthorized attack on your organization with account lockout policy, you can also unintentionally lock out authorized users, which can be quite costly for your organization.
  • If you decide to apply account lockout policy, set the Account lockout threshold policy setting to a high enough number that authorized users are not locked out of their user accounts simply because they mistype a password.
  • Authorized users can be locked out if they change their passwords on one computer, but not on another computer. The computer that is still using the old password will continuously attempt to authenticate the user with the wrong password, and it will eventually lock out the user account. This might be a costly consequence of defining account lockout policy, because the authorized users cannot access network resources until their accounts are restored. This issue does not exist for organizations that only use domain controllers that are running Windows Server 2003 family operating systems.
  • For more information about account lockout policy, see Account lockout policy overview. For information about how to apply or modify account lockout policy, see To apply or modify account lockout policy.


How to...

  • Change an existing password
  • Reset a password
  • Reset a local user account password with a password reset disk
  • Create a password reset disk
  • Apply or modify password policy
  • Apply or modify account lockout policy
  • Create or update a system key


Change an existing password

Microsoft Windows Graphic

To change an existing password

  1. Press CTRL+ALT+DEL.
  2. Click Change Password.
  3. In User name, type the user name of the account that you want to change the password for.
  4. In Old Password, type the existing password.
  5. In New Password and in Confirm New Password, type the new password, and then click OK.

Note

  • XOX

Related Topics


Reset a password

Microsoft Windows Graphic

To reset a password

For a local user account

  1. Open Computer Management (Local).
  2. In the console tree, double-click Local Users and Groups.

    Where?

    • Computer Management (Local)
    • System Tools
    • Local Users and Groups
  3. In the console tree, click Users.
  4. In the details pane, right-click the user name, and then click Set Password.
  5. Read the warning message, and then, if you want to continue, click Proceed.
  6. In New password and in Confirm password, type a new password, and then click OK.

Notes

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. Power Users can reset passwords of accounts they create. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX

For a domain user account, and you are on a member server or a workstation that is joined to the domain

  1. Open Microsoft Management Console (MMC).
  2. On the File menu, click Add/Remove Snap-in, and then click Add.
  3. Click Active Directory Users and Computers, and then click Add.
  4. Click Close, and then click OK.
  5. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers
    • Domain name
    • Users
  6. In the details pane, right-click the user name, and then click Reset Password.
  7. Type a new password in New password and in Confirm password, and then click OK.

Notes

  • XOX
  • XOX

For a domain user account, and you are on a domain controller or on a workstation that has the Windows Server 2003 Administration Tools Pack installed

  1. Open Active Directory Users and Computers.
  2. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers
    • Domain name
    • Users
  3. In the details pane, right-click the user name, and then click Reset Password.
  4. Type a new password in New password and in Confirm password, and then click OK.

Notes

  • XOX
  • XOX

Caution

  • After a user's password is reset, some types of information are no longer accessible, including the following:
    • E-mail that is encrypted with the user's public key
    • Internet passwords that are saved on the computer
    • Files that the user has encrypted
    To prevent data loss when you reset a local user account password, use a password reset disk to reset the password. For more information about password reset disks, see Related Topics.
  • Because data can be lost when passwords are reset, use this procedure only if there is no other way to access the account.

Related Topics


Reset a local user account password with a password reset disk

Microsoft Windows graphic

To reset a local user account password with a password reset disk

  1. Start your computer, or log off from it.
  2. At the Welcome to Windows dialog box, press CTRL+ALT+DEL. In User name, type your user name, and then click OK. The Logon Failed dialog box appears.
  3. Click Reset, and then insert your password reset disk into drive A.
  4. Follow the instructions in the Password Reset Wizard to create a new password.
  5. Log on to your computer with the new password, and then store your password reset disk in a safe place, in case you need it to reset your password in the future. It is not necessary to make a new password reset disk when you change your password.

Notes

  • Follow the steps in this procedure if you are logging on to a local or workgroup environment. For information about how to reset a forgotten password if you are in a domain environment, see "Reset a password" in Related Topics.
  • A password reset disk must have been created for the local account for the Logon Failed dialog box to appear. If a password reset disk has not been created, the Logon Message dialog box appears, informing you that your logon information is incorrect. If a password reset disk has not been created, and the user account password has been forgotten, you must reset the password to access the user account. For more information about resetting passwords, see "Reset a password" in Related Topics.

Related Topics


Create a password reset disk

Microsoft Windows Graphic

To create a password reset disk

  1. Press CTRL+ALT+DEL, and then click Change Password.
  2. In User name, type the user name of the account that you want to create a password reset disk for.
  3. In Log on to, click your LocalComputerName.
  4. Click Backup.
  5. Follow the steps in the Forgotten Password Wizard until the procedure is complete. Store the password reset disk in a safe and secure place.

Notes

  • Password reset disks can only be used for local computer accounts, not for domain accounts.
    • For information on how to reset passwords for domain accounts, see "Reset a password" in Related Topics.
  • You cannot change your password and create a password reset disk at the same time. If you type a new password in New Password and in Confirm New Password before you click Backup, the new password information is not saved. When the wizard prompts you for your current user account password, you must type the old password. You can change your password after you create the password reset disk.
  • You can change your password any time after you create a password reset disk. You do not have to create a new password reset disk if you change your password or if the password is reset manually.

Related Topics


Apply or modify password policy

Microsoft Windows Graphic

To apply or modify password policy

For a local computer

  1. Open Local Security Settings.
  2. In the console tree, click Password Policy.

    Where?

    • Security Settings
    • Account Policies
    • Password Policy
  3. In the details pane, right-click the policy setting that you want, and then click Properties.
  4. Select the options that you want, and then click OK.

Notes

  • XOX
  • XOX

For a domain, and you are on a member server or a workstation that is joined to the domain

  1. Open Microsoft Management Console (MMC).
  2. On the File menu, click Add/Remove Snap-in, and then click Add.
  3. Click Group Policy Object Editor, and then click Add.
  4. In Select Group Policy Object, click Browse.
  5. In Browse for a Group Policy Object, select a Group Policy object (GPO) in the appropriate domain, site, or organizational unit—or create a new one, click OK, and then click Finish.
  6. Click Close, and then click OK.
  7. In the console tree, click Password Policy.

    Where?

    • Group Policy Object [computer name] Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Account Policies
    • Password Policy
  8. In the details pane, right-click the policy setting that you want, and then click Properties.
  9. If you are defining this policy setting for the first time, select the Define this policy setting check box.
  10. Select the options that you want, and then click OK.

Notes

  • XOX
  • XOX

For a domain, and you are on a domain controller or on a workstation that has the Windows Server 2003 Administration Tools Pack installed

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the domain or organizational unit that you want to set Group Policy for.
  3. Click Properties, and then click the Group Policy tab.
  4. Click an entry in Group Policy Object Links to select an existing Group Policy object (GPO), and then click Edit. You can also click New to create a new GPO, and then click Edit.
  5. In the console tree, click Password Policy.

    Where?

    • Group Policy Object [computer name] Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Account Policies
    • Password Policy
  6. In the details pane, right-click the policy setting that you want, and then click Properties.
  7. If you are defining this policy setting for the first time, select the Define this policy setting check box.
  8. Select the options that you want, and then click OK.

Notes

  • XOX
  • XOX

Note

  • Password policy ensures that all users are creating passwords that adhere to the guidelines set by administrators. For more information about each of the password policy settings, see "Password policy" in Related Topics.

Related Topics


Apply or modify account lockout policy

Microsoft Windows Graphic

To apply or modify account lockout policy

For a local computer

  1. Open Local Security Settings.
  2. In the console tree, click Account Lockout Policy.

    Where?

    • Security Settings
    • Account Policies
    • Account Lockout Policy
  3. In the details pane, right-click the policy setting that you want, and then click Properties.
  4. Select the options that you want, and then click OK.

Notes

  • XOX
  • XOX

For a domain, and you are on a member server or a workstation that is joined to a domain

  1. Open Microsoft Management Console (MMC).
  2. On the File menu, click Add/Remove Snap-in, and then click Add.
  3. Click Group Policy Object Editor, and then click Add.
  4. In Select Group Policy Object, click Browse.
  5. In Browse for a Group Policy Object, select a Group Policy object in the appropriate domain, site, or organizational unit—or create a new one, click OK, and then click Finish.
  6. Click Close, and then click OK.
  7. In the console tree, click Account Lockout Policy.

    Where?

    • Group Policy Object [computer name] Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Account Policies
    • Account Lockout Policy
  8. In the details pane, right-click the policy setting that you want, and then click Properties.
  9. If you are defining this policy setting for the first time, select the Define this policy setting check box.
  10. Select the options that you want, and then click OK.

Notes

  • XOX
  • XOX

For a domain, and you are on a domain controller or on a workstation that has the Windows Server 2003 Administration Tools Pack installed

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the domain or organizational unit that you want to set Group Policy for.
  3. Click Properties, and then click the Group Policy tab.
  4. Click an entry in Group Policy Object Links to select an existing Group Policy object (GPO), and then click Edit. You can also click New to create a new GPO, and then click Edit.
  5. In the console tree, click Account Lockout Policy.

    Where?

    • Group Policy Object [computer name] Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Account Policies
    • Account Lockout Policy
  6. In the details pane, right-click the policy setting that you want, and then click Properties.
  7. If you are defining this policy setting for the first time, select the Define this policy setting check box.
  8. Select the options that you want, and then click OK.

Notes

  • XOX
  • XOX

Caution

  • When account lockout policy is enabled, there is a risk of locking out legitimate users. To avoid locking out legitimate users who have simply mistyped or misremembered their passwords, set the account lockout threshold to a high number.

    • Also, if a password is changed on one computer, but the user is logged on to another computer with the old password, the computer with the old password continuously attempts to authenticate the user by using the old password, and it eventually locks out the user account. This issue does not exist for organizations that only use domain controllers that are running Windows Server 2003 family operating systems.

Note

  • For more information about each of the account lockout policy settings, see "Account Lockout Policy" in Related Topics.

Related Topics


Create or update a system key

Microsoft Windows Graphic

To create or update a system key

  1. Click Start, click Run, type syskey, and then click OK.
  2. Click Encryption Enabled, and then click Update.
  3. Click the option that you want, and then click OK.

    For information about each option, see "The system key utility" in Related Topics.

Notes

  • Different administrative credentials are required to perform this procedure, depending on your environment:
    • If you create or update a system key for your local computer: XOX
    • If you create or update a system key for a domain controller: XOX
  • If the disk that stores the system key is lost, or if the system key password is forgotten, you cannot start the computer without restoring the registry to the state it was in before the system key was used. For more information on restoring the registry, see Related Topics.

Related Topics


Concepts

This section covers:
  • Strong passwords
  • Password reset disks
  • Preventing data loss from password resets
  • Account lockout policy overview
  • The system key utility


Strong passwords

The role that passwords play in securing an organization's network is often underestimated and overlooked. Passwords provide the first line of defense against unauthorized access to your organization. The Microsoft® Windows® Server 2003 family has a new feature that checks the complexity of the password for the Administrator account during setup of the operating system. If the password is blank or does not meet complexity requirements, the Windows Setup dialog box appears, warning you of the dangers of not using a strong password for the Administrator account. If you leave this password blank, you will not be able to access this account over the network.

Weak passwords provide attackers with easy access to your computers and network, while strong passwords are considerably harder to crack, even with the password-cracking software that is available today. Password-cracking tools continue to improve, and the computers that are used to crack passwords are more powerful than ever. Password-cracking software uses one of three approaches: intelligent guessing, dictionary attacks, and brute-force automated attacks that try every possible combination of characters. Given enough time, the automated method can crack any password. However, strong passwords are much harder to crack than weak passwords. A secure computer has strong passwords for all user accounts.

A weak password:

  • Is no password at all.
  • Contains your user name, real name, or company name.
  • Contains a complete dictionary word. For example, Password is a weak password.

A strong password:

  • Is at least seven characters long.
  • Does not contain your user name, real name, or company name.
  • Does not contain a complete dictionary word.
  • Is significantly different from previous passwords. Passwords that increment (Password1, Password2, Password3 ...) are not strong.
  • Contains characters from each of the following four groups:
    • Group | Examples
Uppercase letters | A, B, C ...
Lowercase letters | a, b, c ...
Numerals | 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
Symbols found on the keyboard (all keyboard characters not defined as letters or numerals) | ` ~ ! @ # $ % ^ & * ( ) _ + - = { } | [ ] \ : " ; ' < > ? , . /

An example of a strong password is J*p2leO4>F.

A password can meet most of the criteria of a strong password but still be rather weak. For example, Hello2U! is a relatively weak password even though it meets most of the criteria for a strong password and also meets the complexity requirements of password policy. H!elZl2o is a strong password because the dictionary word is interspersed with symbols, numbers, and other letters. It is important to educate users about the benefits of using strong passwords and to teach them how to create passwords that are actually strong.

You can create passwords that contain characters from the extended ASCII character set. Using extended ASCII characters increases the number of characters that you can choose when you create a password. As a result, it might take more time for password-cracking software to crack passwords that contain these extended ASCII characters than it does to crack other passwords. Before using extended ASCII characters in your password, test them thoroughly to make sure that passwords containing extended ASCII characters are compatible with the applications that your organization uses. Be especially cautious about using extended ASCII characters in passwords if your organization uses several different operating systems.

You can find extended ASCII characters in Character Map. Some extended ASCII characters should not be used in passwords. Do not use a character if a keystroke is not defined for it in the lower-right corner of the Character Map dialog box. For more information about how to use Character Map, see Using Character Map.

Examples of passwords that contain characters from the extended ASCII character set are kUµ!¶0o and Wf©$0k#»g¤5ªrd.

You can implement a password policy setting that enforces password complexity requirements. For more information about this policy setting, see Password must meet complexity requirements. For information about how to apply a password policy, see To apply or modify password policy.

Windows passwords can be up to 127 characters long. However, if you are on a network that also has computers running Windows 95 or Windows 98, consider using passwords that are not longer than 14 characters. Windows 95 and Windows 98 support passwords of up to 14 characters. If your password is longer, you might not be able to log on to your network from those computers.

For more information about passwords, see Passwords.


Password reset disks

It is not unusual for users to forget their passwords to local user accounts from time to time, especially when they use strong passwords. Before the advent of password reset disks, the only way for administrators to restore a forgotten local user account password was to manually reset the user's password. In the process, the following information was lost:

  • E-mail that was encrypted with the user's public key
  • Internet passwords that were saved on the computer
  • Files that the user had encrypted

Password reset disks offer another solution to the problem of a forgotten password for a local user account. If users create password reset disks for their local accounts before they forget their passwords, they can reset the passwords without losing valuable data that was lost previously with administrative password resets.

When you create a password reset disk, a public key and private key pair are created. The private key is stored on a disk: the password reset disk. The public key encrypts the local user account password. If users forget their passwords, they can insert the password reset disk, which contains the private key, and decrypt the current password. The Forgotten Password Wizard prompts the user for a new password, which is then encrypted with the public key. Data is not lost because, basically, the user is simply changing a password. It is essential that password reset disks be stored in secured locations. For more information on how to create a password reset disk, see To create a password reset disk.

For more information about encryption, see Encryption. For more information about passwords, see Passwords.


Preventing data loss from password resets

To keep protected information secure, after a user's password is reset, some types of information are no longer accessible, including the following:

  • E-mail that is encrypted with the user's public key
  • Internet passwords that are saved on the computer
  • Files that the user has encrypted

To avoid such data loss, do not reset a user's password. When a new local user account is created, have the user create a password reset disk. Then, if the user forgets the password, the password reset disk can be used to reset the password without data loss. If a user forgets the password to a domain user account, the password must be reset manually.

For more information about how to create a password reset disk, see To create a password reset disk.


Account lockout policy overview

Account lockout policy disables a user account if an incorrect password is entered a specified number of times over a specified period. These policy settings help you to prevent attackers from guessing users' passwords, and they decrease the likelihood of successful attacks on your network. For more information about how to implement account lockout policy, see To apply or modify account lockout policy.

Before you enable account lockout policy, it is important to realize that there is a risk of unintentionally locking authorized users out of their accounts. Such a result can be quite costly for your organization, because locked-out users cannot access their user accounts until the account unlocks automatically after a specified amount of time or until you unlock the accounts for them.

Authorized users can lock themselves out of an account by mistyping their password or by remembering it incorrectly, or by changing their password on a computer while they are logged on to another computer. The computer with the incorrect password continuously tries to authenticate the user, and because the password it is using to authenticate is incorrect, the user account is eventually locked out. This issue does not exist for organizations that only use domain controllers that are running Windows Server 2003 family operating systems. To avoid locking out authorized users, set the account lockout threshold to a high number. Remember, however, that the scenario in which a computer continuously tries to authenticate a user with an incorrect password is very similar to the behavior that is employed by password-cracking software. Setting the account lockout threshold high enough that the authorized user will not be locked out in this situation may inadvertently allow unauthorized access to your network by hackers. For more information about the account lockout threshold, see Account lockout threshold.

For more information about passwords and their policies, see Passwords.


The system key utility

Password information for user accounts is stored in the Security Accounts Manager (SAM) database of the registry on workstations and member servers. On domain controllers, password information is stored in directory services. It is not unusual for password-cracking software to target the SAM database or directory services to access passwords for user accounts. The system key utility (Syskey) provides an extra line of defense against password-cracking software. It uses strong encryption techniques to secure account password information that is stored in the SAM database or in directory services. Cracking encrypted account passwords is more difficult and time consuming than cracking nonencrypted account passwords. For more information on encryption, see Encryption.

There are three system key options in the Startup Key dialog box that are designed to meet the needs of different environments, as described in the following table.

System key option | Relative security level | Description
System Generated Password, Store Startup Key Locally | Secure | Uses a computer-generated random key as the system key and stores an encrypted version of the key on the local computer. This option provides strong encryption of password information in the registry, and it enables the user to restart the computer without the need for an administrator to enter a password or insert a disk.
Administrator generated password, Password Startup | More secure | Uses a computer-generated random key as the system key and stores an encrypted version of the key on the local computer. The key is also protected by an administrator-chosen password. Users are prompted for the system key password when the computer is in the initial startup sequence. The system key password is not stored anywhere on the computer.
System Generated Password, Store Startup Key on Floppy Disk | Most secure | Uses a computer-generated random key and stores the key on a floppy disk. The floppy disk that contains the system key is required for the system to start, and it must be inserted at a prompt during the startup sequence. The system key is not stored anywhere on the computer.

For information on how to implement the system key utility on a computer, see To create or update a system key.

Use of the system key utility is optional. If the disk that contains the system key is lost, or if the password is forgotten, you cannot start the computer without restoring the registry to the state it was in before the system key was used. For information on restoring the registry, see To restore the registry.


Troubleshooting

What problem are you having?

I changed the password policy, but the changes have not taken effect.

Cause: Policy settings have not been updated.

Solution: Click Start, click Run, type gpupdate, and then click OK. This refreshes policy settings, and it updates the changes to password policy on the computer.

See also: Gpupdate

When I define a policy setting in account lockout policy, the Suggested Value Changes dialog box opens, suggesting that I change my other policy settings.

Cause: Account lockout duration must be greater than or equal to the time defined in Reset account lockout counter after. If you define the policy settings so that the Reset account lockout counter after time is greater than Account lockout duration, the Suggested Value Changes dialog box appears, reminding you to change the policy settings so that they adhere to the policy setting guidelines.

Solution: In the Suggested Value Changes dialog box, click OK to change the policy settings to the suggested values, or click Cancel, and then define the policy settings yourself.

See also: Account Lockout Policy; To apply or modify account lockout policy

I am trying to log on to Windows 95, Windows 98, or another product, and the password is not working.

Cause: The password is longer than 14 characters. Windows 95 or Windows 98 computers only recognize passwords that are 14 characters or less.

Solution: Log on to another computer and change the password so that it is 14 characters or less.

See also: To change an existing password; Strong passwords

Cause: The system that you are using does not support unusual characters, such as spaces or characters in the extended ASCII character set.

Solution: Log on to another computer and change the password so that it does not contain these special characters.

See also: To change an existing password; Strong passwords