-: In this lesson, we're going to jump into the lab,
and I'm going to tell you how to create good group policies
for your passwords.
We're going to focus on four key areas.
We're going to talk about complexity, length,
password reuse, and password age.
Let's go ahead and jump in the lab environment
and get started.
In order for us to create our password policies,
we're going to use the group policy editor.
I'm using a Windows 10 machine here
on a local computer network that is not part of a domain.
Using a domain environment,
you can use your global policy orchestrator,
but for a local machine,
we're going to stick with the group policy editor.
Now, to do this, we're going to go to
our computer configuration and click on "Windows settings,"
and then we're going to select, underneath it,
the security settings.
Underneath security settings,
you'll see that we have account policies,
and inside there we have the password policy.
Now you'll see that there are
several different settings here,
including enforcing the password history,
the minimum age, the maximum age,
the minimum password length,
the password that must meet complexity requirements,
and storing your passwords using reversible encryption.
So first we're going to go through and set up our complexity.
Complexity talks about how that password needs to be.
Does it need to have upper case and lower case?
Special characters and numbers?
So if we right click it and go to properties,
we can then select it,
and just simply enable it, and hit apply.
This is going to require that our password now have complexity.
It means it's going to have at least characters
from three of the following four categories.
That would be upper case, lower case,
numbers, and special characters.
So if I have something that has password 1 exclamation,
that would meet password complexity,
according to this definition.
Next we'll hit "okay."
and we're going to go to our next thing,
which is going to be our minimum password length.
Right now, that is zero characters.
Zero characters means I can have a blank password.
Now if you remember from my lessons,
what did I recommend that we use?
Something of at least 14 characters, or more.
According to the Security Plus exam,
we want at least eight characters.
And so, we would have a minimum of eight characters.
But for your security, and mine,
I'm going to use 14 characters.
And again you'll hit "apply."
And if you look at the explanation,
it explains that you can have it
anything between one and 20 characters.
If you have it set to zero, it would be no password.
Go ahead an hit "okay."
And the next thing we're going to do is our password age.
How old must our password be?
Can our password be change and be zero days?
That's fine.
What is the maximum?
Right now it's saying 42 days.
That means every 42 days,
I'm going to have to change that password.
If you remember what I recommended,
it was something like 90 days, right?
And so we can hit "apply," and we can go to explain.
42 is a fine number, it's short,
but that's the default that they have right now.
Some place between 30 and 90 days.
If it's for your home network,
90 days is sufficient and will have you
changing it often enough.
You can actually change this
anywhere between one and 999 days.
You can also set it so that it never expires.
I do not recommend doing that.
And our final setting is password history.
This means how many passwords will
Windows remember and not let you use again?
For example, let's say my password was "password,"
and then I change it to "password1"
and then I change it to "password2."
That is three different passwords I've used.
So if I set that to three,
I would then have to make another one called "password3"
before I could go back to the original one of "password."
That's the idea here.
Generally in high security environments,
you want something like 24.
If you're in a lower security environment,
something like five would be fine.
Because, if you change it five times
and you're doing it every 90 days,
you're going to go about a year and a third
before you have to change it again,
or about a year and a half.
And if you go to the explanation again,
this gives you that same explanation.
If you have zero, that means you can
constantly reuse the same password.
So if I require you to change your password every 90 days,
but I left the password history at zero,
guess what I can do?
Change my password to the same password.
And that resets the 90 day clock and go again.
Not a very good thing for security.
So now you understand some of the basic group policies
that you can set inside here for your passwords.
And something like this is a fairly adequate setup
for a small or medium size business.
If you want to make it more secure,
you can do that by minimizing the password age,
take that down to 30 days, maybe,
and maximizing your password history.
Something more like 24.
So that's the idea here when you're using
your local group policy editor.
If you're doing this on a domain,
you can then take that and push this policy out
to every single computer on the domain
and they'll a ll have to follow your
new strong password policy.
(techno music)