Windows Server 2003 Recommended Baseline Security

Unclassified ITSG for Windows Server 2003
Combined with the ‘PasswordComplexity’ and ‘MaximumPasswordAge’ settings, these settings
ensure the password is strong and resilient to attack.
4.3.1.5 Password must meet complexity requirements
PasswordComplexity = 1
The ‘PasswordComplexity’ switch defines password complexity requirements. The setting ‘1’
requires the user to enter a password that meets the criteria below.
The password contains characters from three of the following four categories:
• Upper Case Character (A-Z)
• Lower Case Character (a-z)
• Base 10 Digits (0-9)
• Non-alphanumeric (! @ # $ % ^ &)
This setting helps thwart brute-force attacks.
4.3.1.6 Store password using reversible encryption
ClearTextPassword = 0
The ‘ClearTextPassword’ keyword determines if the system stores passwords using reversible
encryption. The setting ‘zero’ disables reversible encryption.
NOTE:
Never enable this option unless operational considerations outweigh the need to
protect password information.
4.3.2 Account Lockout Policy
4.3.2.1 Account Lockout Duration
LockoutDuration = 15
The ‘LockoutDuration’ defines the length of time (in minutes) that an account is disabled after
lockout. The setting ‘15’ disables the user’s account for 15 minutes. This value needs to be
synchronized with ‘ResetLockoutCounter’ so the user can logon when the ‘LockoutDuration’
has expired.
4.3.2.2 Account lockout threshold
LockoutBadCount = 10
The ‘LockoutBadCount’ defines the number of failed logons allowed before the account is
locked. The setting ‘10’ causes the user’s account to be locked after 10 consecutive logon
attempts. The setting prevents extended password guessing attacks.
46 March 2004 Server Policy Files