Domain password policy: favour length, rethink lockout
Many domains still enforce a password policy inherited from the 2000s: eight characters, mandatory complexity, a change every three months. These rules produce predictable passwords and do not stop today's attacks. ANSSI and NIST guidance has moved on, and domain configuration should follow.
Where the domain policy lives
The password policy for domain accounts is defined by the Group Policy object linked to the domain root, in practice the Default Domain Policy. A single policy therefore applies to all domain accounts; password settings in GPOs linked to OUs only affect the machines' local accounts. To apply different rules to certain populations, use fine-grained password policies (PSOs), attached to groups or users and managed from the Active Directory Administrative Center.
Length before complexity
Current guidance converges: length is the factor that matters most. A complexity requirement (uppercase, lowercase, digit, special character) on a short password produces patterns everybody knows, such as a dictionary word followed by a year and an exclamation mark. A long passphrase made of several words is easier to remember and far more expensive to guess.
Key directions:
- substantially raise the minimum length, especially for privileged accounts and for service accounts that cannot be gMSAs;
- encourage passphrases rather than complex passwords;
- drop systematic periodic changes in favour of changes upon suspected compromise, as NIST recommends;
- reject known, breached or organisation-related passwords (company name, season, city).
Exact values depend on sensitivity and on the other controls in place (multifactor authentication, monitoring). Refer to the current versions of ANSSI's guides and NIST SP 800-63B rather than to figures copied from an old internal memo.
A technical note: the Group Policy interface historically capped the minimum length at 14 characters. Recent Windows Server versions offer a setting to relax that limit; check it is supported on every domain controller before using it. PSOs do not have this limit.
Blocking weak passwords
Complexity rules do not catch "Company2024!". A banned password list does. Microsoft Entra Password Protection extends Microsoft's global list and a custom list to on-premises domain controllers, through an agent that checks every password change. To benefit from it, deploy the agent on every DC and move from audit mode to enforcement after an observation period.
Lockout versus password spraying
Account lockout protects against targeted brute force: many attempts against one account. It is ineffective against password spraying, which tries a handful of very common passwords across many accounts while staying below the threshold. Lowering the threshold drastically changes nothing and invites denial of service: an attacker, or a misconfigured script, can lock out thousands of accounts.
| Setting | Purpose | Watch out for |
|---|---|---|
| Account lockout threshold | number of failures before lockout | too low: denial of service; zero: no protection against brute force |
| Account lockout duration | how long the account stays locked | automatic unlock reduces helpdesk load |
| Reset account lockout counter after | window in which failures are counted | must be consistent with the lockout duration |
The answer to spraying lies mainly in hard-to-guess passwords, a banned password list and detection of failures spread across many accounts (events 4625 and 4771, or Defender for Identity).
Never enable. The "Store passwords using reversible encryption" setting must stay disabled in the domain policy and in PSOs. If it was ever enabled, the affected accounts must change their passwords after it is turned off.
What an audit checks
- the effective settings of the Default Domain Policy and PSOs, and their targets;
- the minimum length applied to privileged and service accounts;
- whether a banned password list is in place and how it operates;
- the consistency of lockout threshold and duration;
- accounts whose password never expires, is not required, or has not changed in a long time.