Stop Students using inappropriate words for passwords

[Renfield-64]

Hi

Does anyone know how to stop students using inappropriate words for passwords?

I have just started allowing students to change their passwords by changing the settings in GPO to allow the option on Alt+Ctrl+Del but can't find any settings for how to block words.

We use Netcare Solution Suite 1.0.36 on Server 2012.

[synaesthesia]

Why is that a concern? Noone can see the passwords including yourself or anyone else, they pose no threat and shouldn't be provided to anyone.

[Renfield-64]

Well its just not good is it. some kids will fall out with someone and change their own password to *insertinapropriatewordhere* or something. It will then become know to a few and create problems. Edited September 6, 2013 by john
We get what you mean no need to swear in that post

[synaesthesia]

I think you're overcomplicating it for no reason. Having their password set to something like that is no different to just thinking it - noone knows they're thinking it, unless they tell them. Noone knows that's their password, unless they tell them. There's no built in method of denying words anyway other than username, password etc but no doubt there's some 3rd party stuff that will handle it.

[Renfield-64]

Thanks, you raise some good points there. I hope I can convince our Deputy Head of this.

[MatthewL]

Can't believe I am reading this, maybe you should be educating your users about not sharing passwords and then it doesn't matter what is it set to because they will then know not to share their password. Quite simple really.

[Renfield-64]

Its not about sharing passwords, its about being able to have their own password which I disabled a couple of years ago as it gave me so much hassle. The problem as you know with children having their own passwords and changing them often is that I am the one who has to sort it out when they have forgotten it. Its not like when they are online and have an automated password recovery option to press!

[pantscat]

That's a pastoral rather than a technical issue...

[nicholab]

I don't under stand the forgotten password issue they must use it every other day.

[Renfield-64]

:(Believe me its not! Person in charge of pastoral duties does not sort out forgotten passwords, its a technician problem. Surely I am not the only one with this issue of forgotten passwords.

[Renfield-64]

I don't under stand the forgotten password issue they must use it every other day.

 

They have an ICT lesson once a week, they may logon at other times such as lunchtime computer club, booster sessions etc. but if they change their password often, ie; best friend's name (which can change daily!) its no wonder they forget it, or forget how to spell it!

[synaesthesia]

There's a few things you can do to push this onto staff - users of the likes of Impero and what not will already be aware of what can be done, but you could also allow the basic AD user tool to be installed on teacher PCs for teacher use only, so they can have access to change the pass of children. One good thing about doing this, and oft-discussed here is that technicians rarely know who the kids are (unless they're pains in the backsides!) so we can't verify their identity. Their teachers however can, therefore onus on changing passwords should really be theirs.

[Iain]

They have an ICT lesson once a week, they may logon at other times such as lunchtime computer club, booster sessions etc. but if they change their password often, ie; best friend's name (which can change daily!) its no wonder they forget it, or forget how to spell it!

 

A minimum password age requirement would prevent them changing it too often.

[Ephelyon]

There are also free self-service password reset solutions out there. It sounds like this is a primary school though?

[Renfield-64]

A minimum password age requirement would prevent them changing it too often.

How do you mean minimum age requirement?

[Disease]

:(Believe me its not! Person in charge of pastoral duties does not sort out forgotten passwords, its a technician problem. Surely I am not the only one with this issue of forgotten passwords.

 

We delegate permission to staff to change passwords and use "password control" to allow staff to change passwords, it's great no more hassle changing passwords for student and less disruption for the teacher as pupils do not need to leave the class.

[Renfield-64]

There are ways to enable teachers to reset student passwords. Sending students out of lesson to IT to have their password reset is itself an issue. Students quickly realize if they cannot logon they cant do any work and so 10 minutes out of lesson to sort it out is a trick they pickup to dodge working.

 

The business about censored passwords is also laughable. If a child writes "the head of Maths is a c0ck" on their text book, do you invest time and money to prevent ink sticking on the book or do you address this differently? Sound to be like teaching and learning make IT bend to their way of working rather than adapting teaching and learning around technology.

 

I am based in the ICT suite so they don't need to leave the room unless they were logging on elsewhere.

I agree with what you are saying about stopping ink sticking to paper etc.

[Renfield-64]

How does this work then? How can i install the basic AD user tool?

[plexer]

How do you mean minimum age requirement?

 

You change the policy setting for minimum age say 14 days that way they can't change it everyday.

 

I don't think they meant actually resetting passwords was a pastoral problem rather the education of students on what to choose for a password.

 

Ben

[Renfield-64]

Ah I see, you mean minimum time to change password. That sounds quite useful as a start.

[Ephelyon]

How do you mean minimum age requirement?

 

You have to be over 16 to change your password.

 

Seriously considering that policy!

[Renfield-64]

We delegate permission to staff to change passwords and use "password control" to allow staff to change passwords, it's great no more hassle changing passwords for student and less disruption for the teacher as pupils do not need to leave the class.

 

This sounds useful then the staff can do it. Do you do this in AD or somewhere else?

[jamesb]

This gives details of how to delegate the Unlock Account right - How To Delegate the Unlock Account Right

 

It's similar for all other delegation of rights over accounts. There are also various tools available which'll make it even easier for them.

 

Setting minimum password age is detailed here, and means that a password cannot be changed until it has been used for the length of time set: Minimum password age: Security Configuration Editor; Security Services

[Renfield-64]

many thanks, I'll give it a go.

[ChrisMiles]

You could easily do this by re-blocking the students from changing their password through Ctrl-Alt-Delete and using a 3rd party application which can first filter their data entry for bad words. i could knock something up in half hour to do that.

 

I do however agree with the above comments that it is a futile exercise, and anyway if you block the word bastard they will simply type b4sta4rd instead, it makes no difference to them.