AD 2003 Password Complexity and French Keyboard drivers

AD 2003 Password Complexity and French Keyboard drivers

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
AD 2003 Password Complexity and French Keyboard drivers =?Utf-8?B?TkhEaXZlckFkbWlu?= 05-16-2007
Posted by =?Utf-8?B?TkhEaXZlckFkbWlu?= on May 16, 2007, 12:43 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hello, figured I'd throw this around here before buying an answer. I've got
an international client who are having trouble with password complexity,
particularly in non-english countries (France, Italy) using their countries
Windows kb drivers and keyboards.

AD Default Domain Policy has the password complexity set to Disabled. The
servers are using Microsoft's passflt.dll to enforce complexity. Passwords
be 6 in length, 1 day in age. HD personnel sets a French user's password to
"Monde7" with password change required. The user logs in and is prompted for
a change, but won't accept any passwords that match the standard complexity
rules (tried many things like Friends1, !Friends^, ILtheBA!!, but all to no
avail).

1. Just what really are the hard, true password rules from Microsoft on
complexity - their published information is incorrect.
2. Is anyone having problems with password complexity simply because of
different national keyboard drivers and layouts?

The two unusual things here are that I'm not experienced with using
complexity, except for on my NT4 or older servers, being controlled by
anything except AD policy, and I've not had any great depth supporting world
wide users with Microsoft products. Thanks in advance for your input!

Posted by =?Utf-8?B?SWFu?= on May 22, 2007, 5:33 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Never used European keyboards, but my feelings are that a password-lockout
policy (which for some strange reason is omitted from the default policy)
will go much further toward securing the computers, and without the
user-aggro.

Basically, if a hacker has only three or five tries then even a simple
password is reasonably secure. No password is secure if the hacker has an
infinite number of tries.



Posted by =?Utf-8?B?SWFu?= on May 22, 2007, 5:51 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Might also add that I recall in one instance having difficulty clearing this
Password Complexity policy on 2003 Server. I think your problem might be
down-to it not having cleared properly, rather than a keyboard issue. Suggest
trying the policy-change again, and possibly restart the server and clients
before testing, to make sure the change 'sticks.'

In light of that experience I tend to remove this policy rightaway, before
any clients get to log-on.



Posted by S. Pidgorny on May 22, 2007, 6:55 am
If you were  Registered and logged in, you could reply and use other advanced thread options
G'day:

news:9BAA5EF4-C55D-413A-9597-

> Basically, if a hacker has only three or five tries then even a simple
> password is reasonably secure. No password is secure if the hacker has an
> infinite number of tries.

I like 200. No human will do that many retries - will clearly signal either
attack or malfunctioning software. The account lockout event in the event
log will be more valuable for monitoring then.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *



Posted by =?Utf-8?B?Um9uTU0z?= on May 30, 2007, 11:57 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Thank you for your replies, they did help as did some documentation from a
parent company about their custom password filter file! Got to love it as
the various pieces come to light. Most of the problem was in the logic of
the dll, and they like it so I'll leave it be. :)

"NHDiverAdmin" wrote:

> Hello, figured I'd throw this around here before buying an answer. I've got
> an international client who are having trouble with password complexity,
> particularly in non-english countries (France, Italy) using their countries
> Windows kb drivers and keyboards.
>
> AD Default Domain Policy has the password complexity set to Disabled. The
> servers are using Microsoft's passflt.dll to enforce complexity. Passwords
> be 6 in length, 1 day in age. HD personnel sets a French user's password to
> "Monde7" with password change required. The user logs in and is prompted for
> a change, but won't accept any passwords that match the standard complexity
> rules (tried many things like Friends1, !Friends^, ILtheBA!!, but all to no
> avail).
>
> 1. Just what really are the hard, true password rules from Microsoft on
> complexity - their published information is incorrect.
> 2. Is anyone having problems with password complexity simply because of
> different national keyboard drivers and layouts?
>
> The two unusual things here are that I'm not experienced with using
> complexity, except for on my NT4 or older servers, being controlled by
> anything except AD policy, and I've not had any great depth supporting world
> wide users with Microsoft products. Thanks in advance for your input!

Similar ThreadsPosted
Password Complexity December 8, 2005, 12:32 pm
Password complexity May 12, 2008, 3:02 pm
Policy for Password Complexity July 21, 2006, 1:25 pm
Change password complexity July 14, 2008, 6:26 pm
MSBA - Password Complexity Checking July 7, 2005, 11:15 am
Password complexity in W2K Pro/Serv network September 12, 2005, 2:01 pm
Re: Password complexity in W2K Pro/Serv network October 4, 2005, 2:35 am
Re: Good password change fails due to complexity. September 1, 2005, 11:46 am
Good password change fails due to complexity. September 1, 2005, 11:34 am
White screen and corrupt programs and drivers June 19, 2006, 11:48 pm

The site map in XML format XML site map

Contact Us | Privacy Policy