* Configuring Password Policy :
Password Policy allows you to improve security on your computer by controlling how passwords are created and managed. You can specify the maximum length of time a password can be used before the user must change it. Changing passwords decreases the chances of an unauthorized person breaking into your computer. If an unauthorized user has discovered a user account and password combination for your computer, forcing users to change passwords regularly will cause the user account and password combination to eventually fail and lock the unauthorized user out of the system.
Other Password Policy options are available to improve a computer's security. For example, you can specify a minimum password length. The longer the password, the more difficult it is to discover. Another example is maintaining a history of the passwords used. This prevents a user from having two passwords and alternating between them.
You can configure Password Policy on a computer running Windows XP Professional by using the Group Policy snap-in. You use the Group Policy snap-in to configure Password Policy as follows:
Click Start, and then click Run.
Type mmc in the Open text box, and click OK to open an empty custom MMC console.
On the File menu, click Add/Remove Snap-In, and then click Add.
In the Add Standalone Snap-In dialog box, click Group Policy and then click Add.
The Select Group Policy Object dialog box appears, allowing you to point the Group Policy snap-in at the local computer or at a remote computer. The Allow The Focus Of The Group Policy Snap-In To Be Changed When Launching From The Command Line check box allows you to configure the MMC so that you can decide which computer to use Group Policy on when you start the MMC.
Click Finish to leave Group Policy with its focus on the Local Computer, the default setting, and click Close to exit the Add Standalone Snap-In dialog box.
In the Add/Remove Snap-In dialog box, click OK, and save the console with Local Group Policy.
Expand Local Computer Policy, under Computer Configuration expand Windows Settings, expand Security Settings, expand Account Policies, and then click Password Policy.
Select the settings you want to configure, and then on the Action menu, click Properties.
Setting Description
Enforce Password History
The value you enter for this setting indicates the number of passwords to be kept in a password history. The default value of 0 indicates that no password history is being kept. You can set the value from 0 to 24, indicating the number of passwords to be kept in password history. This value indicates the number of new passwords that a user must use before he or she can reuse an old password.
Maximum Password Age
The value you enter for this setting is the number of days a user can use a password before he or she is required to change it.
A value of 0 indicates the password will not expire.
The default value is 42 days and the range of values is 0 to 999 days.
Minimum Password Age
The value you enter for this setting is the number of days a user must keep a password before he or she can change it.
The default value of 0 indicates that the password can be changed immediately. If you are enforcing password history, this value should not be set to 0.
You can set the range of values from 0 to 999 days. This value indicates how long the user must wait before changing his or her password again. Use this value to prevent a user who was forced by the system to change his or her password from immediately changing it back to the old password.
The minimum password age must be less than the maximum password age.
Minimum Password Length
The value you enter for this setting is the minimum number of characters required in a password. The value can range from 0 to 14 characters inclusive.
* Configuring Account Lockout Policy :
The Account Lockout Policy settings also allow you to improve the security on your computer. If no account lockout policy is in place, an unauthorized user can repeatedly try to break into your computer. If, however, you have set an account lockout policy, the system locks out the user account under the conditions you specify in Account Lockout Policy.
You access the Account Lockout Policy settings using the Group Policy snap-in, just as you did to configure the Password Policy settings.
The default value of 0 indicates that no password is required.
Passwords Must Meet Complexity Requirements
The options are Enabled or Disabled (the default).
If enabled, all passwords must meet or exceed the specified minimum password length; must comply with the password history settings; must contain capitals, numerals, or punctuation; and cannot contain the user's account or full name.
Store Password Using Reversible Encryption For All Users In The Domain
The options are Enabled or Disabled (the default).
This enables Windows XP Professional to store a reversibly encrypted password for all users in the domain-for example, to be used with the Challenge Handshake Authentication Protocol (CHAP). This option is only applicable if your computer running Windows XP Professional is in a domain.
The MMC Console displays the properties dialog box for the selected setting. Figure 13.2 shows the properties dialog box for the Maximum Password Age setting.
* To test minimum password length :
Click Start and then click Control Panel.
Click User Accounts and then click Create A New Account.
In the Type A Name For The New Account text box, type User13 and then click Next.
Click Limited and then click Create Account.
Click User13 and then click Change The Password.
In the Type A New Password and the Type The New Password Again To Confirm text boxes, type water.
Click Change Password.
A User Accounts message box appears, indicating that your new password does not meet the password policy requirements. This test proves that you correctly configured the minimum password length account policy to eight characters.
Click OK to close the User Accounts message box.
Click Cancel to close the Change User13's Password window.
Close the What Do You Want To Change About User13's Account window, and then close Control Panel.
* To test Account Policy settings :
Log on as User13 with no password.
Windows XP Professional displays a Logon Message message box indicating that you must change your password at first logon.
Click OK to close the message box.
Press Tab to move to the New Password text box and leave the Old Password text box blank.
In the New Password and Confirm New Password text boxes, type hotwater and then click OK.
Windows XP Professional displays a Change Password message box indicating that your password was successfully changed.
Click OK to close the Change Password message box.
Click Start and then click Control Panel.
Click User Accounts and then click Change My Password.
In the Type Your Current Password text box, type hotwater.
In the Type A New Password and Type The New Password Again To Confirm text boxes, type chocolate.
Click Change Password.
Were you successful? Why or why not?
Close any open message boxes and windows and log off.
*Configuring Account Lockout Policy
To configure Account Lockout Policy settings
Log on to your computer as Fred or with a user account that is a member of the Administrators group.
Click Start and click Run.
In the Open text box, type mmc, and then press Enter.
Open the Local Group Policy custom MMC console you created.
In the Local Group Policy console tree, double-click Account Policies.
Click Account Lockout Policy.
Use Account Lockout Policy settings to do the following:
Lock out a user account after four failed logon attempts.
Lock out user accounts until an administrator unlocks the user account.
Log off Windows XP Professional.
To test Account Lockout Policy settings
Try to log on as User13 with a password of chocolate four times.
Try to log on as User13 with a password of chocolate again and a dialog box appears, indicating that the account is locked out.
Click OK and then log on as Fred or as a user that is a member of the Administrators group.
Good luck !
<email removed>