975 pts.
 Forcing Windows users to choose random passwords
Can we force Windows to choose random passwords for accounts created in 2003 Active Directory? Can we force the user to then change their password on login?

Software/Hardware used:
ASKED: June 6, 2011  2:38 PM
UPDATED: June 14, 2011  1:37 PM

Answer Wiki:
In Active Directory Users and Computers expand the local domain, if you open your company users OU, depending on were you created your users. Right click on the user's account and select properties to open the users properties dialog box On the Account's tab under Account options field You can select the check box "User must change password at next log on" select apply and OK Note that this option is not permanent, as the option is disabled once the user has successfully changed the password and logged on It is also worth noting that if you want your users to have a 'random' password that any domain password settings are done through the default domain policy in Group Policy Management. Any change made here will affect ALL users. It is possible in 2008 to set up multiple password policies but its a bit of a nightmare working out how many milliseconds from the year 1600 it's been. No i'm no kidding.
Last Wiki Answer Submitted:  June 8, 2011  3:27 pm  by  Guardian   900 pts.
All Answer Wiki Contributors:  Guardian   900 pts.
To see all answers submitted to the Answer Wiki: View Answer History.


Discuss This Question:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _


 

Also keep in mind that if you force users to use truly random passwords your help desk is going to get a lot of calls about password problems, and people are going to have their passwords written down on their desks, making the passwords totally useless.

If you want something secure that remains useful, look into using RSA tokens for authentication. Half the password the user knows, and the other half they read from the token and it changes every minute. (Some of the root keys for RSA were compromised recently, so make sure that you get a device with the new keys.)

 64,520 pts.

 

Great point, thanks mrdenny.

 975 pts.