Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
23. Select “Yes” if you wish to save the settings.
a. Otherwise, select “No”.
4.2 Baseline Server Policy Files Details
The following section provides additional services and settings that are managed by policy files.
The Domain and Workgroup Baseline configuration files are largely identical. The following
section provides details on the security settings. Items that are not the same will have both
settings documented.
4.3 Account Policies
Account policies determine the rules for user’s with respect to passwords and Kerberos.
4.3.1 Password Policy
4.3.1.1 Enforce password history
PasswordHistorySize = 24
The ‘PasswordHistorySize’ defines the number of passwords retained by the system. This
history is compared with user input during password changes. The setting ‘24’ requires the user
to select twenty-four unique passwords before they can re-use their first one. With a
‘MinimumPasswordAge’ of two, the user would have to cycle their password every two days to
get back to their original password.
4.3.1.2 Maximum password age
MaximumPasswordAge = 42
The ‘MaximumPasswordAge’ defines the maximum number of days a user can keep the same
password. A setting of forty-two requires the user to change their password every forty-two days.
Combined with the ‘PasswordComplexity’ and ’PasswordLength’ settings, these settings ensure
the password is strong and resilient to attack.
4.3.1.3 Minimum Password Age
MinimumPasswordAge = 2
The ‘MinimumPasswordAge’ defines how many days a user must wait between password
changes. The setting ‘2’ requires the user to wait two before they can change it again.
4.3.1.4 Minimum password length
MinimumPasswordLength = 8
The ‘MinimumPasswordLength’ defines the minimum number of characters acceptable for a
password. The setting ‘8’ requires the user to enter a password of eight characters or more.
Server Policy Files March 2004 45