Password policies are unique within group policy as they can only be set once per domain.
This means that unlike any other policy these need to be set in a group policy that is applied at domain
level.
If for any reason there is more than one password policy in existence on a domain only one will have
any effect.
Although passwords assess on user accounts the settings for password policies are actually in the computer
configuration options and can be found on the computer configuration policies window settings Security
Settings Account policies password policy options here are as follows.
Enforce password history.
This stopped Password Reuse for example using a number to a password and then incrementing the number
every time the password is changed rather than changing the password properly.
Maximum password age just determines how often a user must reset their password.
For example if this is set of 30 a user would have to change their passwords once every 30 days minimum
password age.
This determines how long the user must wait after changing their passwords before they can change it
again.
Minimum password length.
This is the minimum length incorrect ID that a password must be in order to be accepted by the system.
When setting or changing the password password must meet complexity requirements.
This means that when a password is set it must meet the following requirements the user name must not
be contained within the password the password must contain at least three out of the following five
special character types uppercase letters lower case letters numbers special characters unicode characters.
The next option here is store passwords.
Using reversible encryption.
This option allows passwords to be retrieved once set by certain applications but is normally disabled
by default.
In most organizations unless there are very specific circumstances within your company it's normally
a bad idea to enable reversible encryption for passwords as it can have security implications.
Should your network become compromised for any reason.
Some examples of when this may need to be enabled by the existence of some legacy applications that
require domain user authentication but that don't support encryption.
Some examples being digest authentication on a web server or a custom software package that hasn't been
updated for a while.
Now that we've gone over password policies let's move on to policy differences between Windows versions.