Passwords (yet again)

[DavePa]

Following our audit and my subsequent asking for help (thanks all ) we are almost ready to implement our password policy with just a few questions remaining. Up until now we have issued passwords for both staff (minimum 10 characters, complex) and students (6 characters, simple). The new policy requires that staff must set their own passwords although students can be issued passwords as before.I'm trying to find out what others do:

 

Do you enforce password changes for staff AND students or just staff?

(I am favouring just staff at present but our students are post 16 - some are in their 20's and 30's - so they should be familiar with the concept)

Do you have different complexity requirements for staff and students?

(I am favouring standard Microsoft complexity for both with a minimum length of 10 characters)

How frequently do you force a password change?

(The Microsoft standard is 42 days but there is an argument to make it termly or even longer)

What do you do?

[Bedders]

All of our students in years 7 - 11 had 4 numbers randomly selected. These were issued to them in their first IT lesson and could be changed easily if (when!) they forgot.

 

Our sixth form got defaults of 12345 and could then change it. Most of them carried into sixth form from Year 11 so kept their old password originally but were allowed to change it. If any sixth former forgot their password it was reset to something that amused me such as 'muppet', 'rememberme' or 'imustnotforgetmypasswordorthetechnicianmaysetsomethingrude' (yes, that last one actually was used once).

 

Staff got a default (either Password1 or 654321 or something) and could change it.

 

We did not enforce password changes with any form of regularity. It would have created far too many headaches.

 

We also did not enforce complexity for staff, although I did tell them that it required a capital letter and a number which meant most of them stuck a 1 at the end

[alfatec]

We use fine grained password policy for staff and use JiJi password expiration software which sends an email to staff 14 days before the password is due to be changed and every day up until they change it. Students are not required to change their password.

[DavePa]

Thanks both, we are looking at NervePoint to enable self-service password resets but only if staff and students are forced to change passwords - if staff only we will try and cope but if it's students as well then I think we'll need it from the start. Students currently have a 6 digit password and a lot of them forget even that!

[KibosJ]

We have a 60 day policy here for staff and are about to introduce the same for years 9-11.

 

I have a powershell script that sends an email to remind staff their password is about to expire, it does this at 14 days, 7 days, 5 days and then every day.

 

Password complexity is 8 characters (uppercase, lowercase, number) and they cannot use their previous 4 passwords. All seems to work okay here

[unixman_again]

• Usual complexity - 3 of uppercase, lowercase, number or symbol, 8 chars or more, can't have user name or user id
  
• Password changed enforced at first login for both staff and students
  
• Student initial password - dob Sdd/mm/yyyy
  
• Staff initial password - usually something like Password1
  
• Expiry - 110 days but it isn't enforced
  
• If you do change it, you can't use one of the last 3 passwords
  

 

We did have a problem this year in that we had to remove the change at first login for students. They collected their user ids and passwords on enrolment day and although they were encourage to go and login on a computer and change their password, many didn't. They were given instructions on how to setup their college email on their phones and various emails where sent to their college email address between enrolment and first day of teaching. We had loads of calls about students not being able to read these emails, so we had to disable change at first login, as they can't do that on their email client.

[DavePa]

We did have a problem this year in that we had to remove the change at first login for students. They collected their user ids and passwords on enrolment day and although they were encourage to go and login on a computer and change their password, many didn't. They were given instructions on how to setup their college email on their phones and various emails where sent to their college email address between enrolment and first day of teaching. We had loads of calls about students not being able to read these emails, so we had to disable change at first login, as they can't do that on their email client.

 

Good point, I would probably have fallen foul of that as well but will make sure I avoid it now, thanks!