qr code generator c# dll free Lesson 3 in Visual C#

Creating QR Code in Visual C# Lesson 3

6-41

There are five password policies you can use in any Windows Server 2003 network:

The password policy that is part of the Account Policy of the Security Settings por tion of the Group Policy object that is linked to the domain container. This policy dictates the technical controls that will enforce a password policy for all domain accounts. Some security options and individual user account settings also provide technical control. The password policy that affects the accounts in the local database of the member or stand-alone computers. The written password policy. Some of this policy can be enforced with technical controls, some cannot. The policy that is generally practiced at the organization. Ultimately, all policies can affect the security of the information systems. Your job as a designer is to con sider all these password policies not just those that can be technically enforced and to design an appropriate password policy and controls.

One of the first steps in designing a strong password policy is to identify the techni cal controls available for password policies and to review their limitations. This sec tion describes the technical controls for password policies, the security requirements for user account configuration and security options, and the limitations of technical controls.

The technical controls available for password policies have not changed in Windows Server 2003. Controls are located in the Group Policy Password Policy and are extended in the user s individual account. In addition, several security options restrict or extend the policy. The password policy is configured for the local account database in the local Group Policy, for local account databases in member computers in the Group Policy Object (GPO) linked to the container that holds the computer account, and for the entire domain user database in the GPO linked to the domain. GPO settings are located in the Windows Configuration, Security Settings, Account Policy, Password Policy container. Table 6-5 lists and defines the technical controls in the password policy.

6-42

6

Table 6-5

The number of previous passwords that are cached and cannot be reused. Multiply this number times the Minimum Password Age to determine the minimum number of days before a password can be reused. Multiply this number times the Maximum Password Age to determine the maximum number of days before a password might be reused. The number of days after which a password must be changed. The number of days before a newly changed password can be changed again. If this is not set, a user might repeatedly change her password to get around the password history restriction and reuse her original password. The minimum number of characters a password must be. A password can be longer, but it cannot be shorter. Passwords must be composed of at least three of the following: uppercase letters, lowercase letters, numbers, symbols. Passwords are by default hashed and then stored in the password database. Enabling this setting will prevent that from occurring and weaken password protection.

Minimum Password Length Passwords Must Meet Complexity Requirements Store Reversible Passwords Using Encryption

To design a strong password policy, you must also understand the security require ments for user account configuration and the security options that are available. User Account Properties that Affect Passwords Individual differences can be defined in the Account tab of the User s property pages. Table 6-6 lists and defines the technical controls in the individual user s account properties.

Table 6-6

Default Enabled Disabled Definition Requires immediate password change regardless of maximum password period. Password must be changed by an administrator. This is a good choice for a service account. If the account becomes compromised, an attacker cannot change the password and potentially shut down the service.