Can password policies differ for staff & pupils?

[klop]

Hi all, I work for a small SEN school.

 

Ideally I would like to force passwords for complexity and minimum length but just for staff.

Some of our pupils are only able to use single character passwords - but that is ok with us.

 

Is there a way I can use a GPO to enforce staff policies without affecting pupils?

Currently we have a password GPO that has complexity, length, 42 day change etc set with loopback within the staff OU - the 42 days change works but not the others. I understand really the password rules should be set in the Domain Default Policy but of course this would affect our pupils logins too.

 

We have staff who have pretty much pointless passwords and in today's age this seems crazy. I have just spoken with a couple of members of staff who find it funny that I think their passwords should be secure. They simply will not change them. One even suggested if I force them to be secure he will stop using his laptop and complain to SLT that I am stopping his access!!

 

 

We have Server 2016 & Windows 7 Pro clients.

Only thing I can think is to try setting the password policy at the very least in the laptops OU that only staff use - would that work? Would be a step forward - but they'd only have to log into a pupils use PC to have an 'easy' password again!

 

Thanks for any pointers!

[clareq]

Have a look here https://blogs.technet.microsoft.com/meamcs/2012/05/29/creating-fine-grained-password-policies-through-gui-windows-server-2012-server-8-beta/ It's perfectly possible. It might be worth getting SLT on side before you make the change though.

[klop]

That's brilliant - thank you!

[Out_of_Sync]

yes it is possible.

 

I recently did on server 2008, but I understand it is easier in 2016. It is called fine-grained password policy.

[Katy]

It's hidden away in "Active Directory Administrative Centre" in 2012R2 and above, not sure if you can target an OU but you can definitely do it based on security group membership.

[Oaktech]

you can't target an OU - I spent an hour troubleshooting a policy to discover this! You can however target a security group and whilst dipping into ADSI edit is always a nervy thing to do it's actually apiece of cake.

 

I set the most complex requirements in the default domain policy and then create a fine grain policy via adsi edit for the lower requirements. There is a hierachy in which password policies apply - msDS-PasswordSettings object, default domain policy, any other GPO.

 

I'm using a domain with 2008r2 functional level. I go in via adsi edit, then connect to a DC, default naming context, system, password settings container, new, object and then follow through the wizard - defaults are usually fine except for the things you want to change which is likely lockout duration, lockout threshhold, minimum and maximum password ages, password length, complexity requirements and history length.

[dcwhitworth]

Hi all, I work for a small SEN school.

 

Ideally I would like to force passwords for complexity and minimum length but just for staff.

Some of our pupils are only able to use single character passwords - but that is ok with us.

 

Is there a way I can use a GPO to enforce staff policies without affecting pupils?

Currently we have a password GPO that has complexity, length, 42 day change etc set with loopback within the staff OU - the 42 days change works but not the others. I understand really the password rules should be set in the Domain Default Policy but of course this would affect our pupils logins too.

 

We have staff who have pretty much pointless passwords and in today's age this seems crazy. I have just spoken with a couple of members of staff who find it funny that I think their passwords should be secure. They simply will not change them. One even suggested if I force them to be secure he will stop using his laptop and complain to SLT that I am stopping his access!!

 

 

We have Server 2016 & Windows 7 Pro clients.

Only thing I can think is to try setting the password policy at the very least in the laptops OU that only staff use - would that work? Would be a step forward - but they'd only have to log into a pupils use PC to have an 'easy' password again!

 

Thanks for any pointers!

 

As a side note to the technical aspect, I would take this up with SLT. Make them aware that there are staff who are not taking Data Protection seriously and that this probably involves Safeguarding issues also. Get them to approve an appropriate password regime and then implement it.

[klop]

Thanks everyone - had a look using the fine grained and it looks pretty straight forward and simple to do.

 

I've sent an email to our head and deputy (who is also our ict coordinator) expressing my concerns re passwords and what I think we should do to make them secure.

I await their replies!

 

Thanks again :-)

[Liam]

Ms recommend having complexity requires and 8 characters now and actually not having them to change it all the time. That's what I do for our staff.

[ass17]

Ms recommend having complexity requires and 8 characters now and actually not having them to change it all the time. That's what I do for our staff.

 

In addition to this we also don't allow use of last ten passwords. Some staff will be tempted to change it then change it back to what it was previous.....

[klop]

I believe if you set up accounts direct in O365 you have the option to remove password expiration? But that it is set as default to 90 days?

 

Staff here would be very happy if we removed the need for them to change their password every 40ish days.

 

I'm waiting on replies from our deputy & head to see what their initial thoughts are.

[Oaktech]

We still use password expiration - it happens at 90 days for staff otherwise they'd all still have the one they started with.

[Primus]

We still use password expiration - it happens at 90 days for staff otherwise they'd all still have the one they started with.

 

But if the one they started with is complex etc. then that's an advantage over making them change frequently and having them write it down on a post-it attached to the monitor etc.

 

All the guidance and evidence now says don't use password expiration for many many reasons.

[klop]

All the guidance and evidence now says don't use password expiration for many many reasons.

 

O365 still sets a 90 day expiration as default though - can you point me to a Microsoft page suggesting to disable it please? I'd like to show it to our head / deputy head and maybe we'll stop the need for staff to change it.

 

At the very least we'll change it from 40 days to 90 I think

 

Thanks

[Oaktech]

But if the one they started with is complex etc. then that's an advantage over making them change frequently and having them write it down on a post-it attached to the monitor etc.

 

All the guidance and evidence now says don't use password expiration for many many reasons.

 

I see what you're saying, but I really do think 90 days is an acceptable length of time for a password to last. They are obliged to create a complex password every time and it can't be one of the last 4 - so they can't reuse a password within a year.

[Primus]

O365 still sets a 90 day expiration as default though - can you point me to a Microsoft page suggesting to disable it please? I'd like to show it to our head / deputy head and maybe we'll stop the need for staff to change it.

 

At the very least we'll change it from 40 days to 90 I think

 

Thanks

 

https://www.ncsc.gov.uk/articles/problems-forcing-regular-password-expiry

[klop]

Oaktech - do you know if disabling historic passwords stops a user changing the number at the end?

ie, P@ssword!1 would meet length and complexity but could they then use P@ssword!2 P@ssword!3 P@ssword!4 etc ??

 

Thanks

[klop]

https://www.ncsc.gov.uk/articles/problems

 

Brilliant - thank you

[Liam]

I moved away from it a couple of years ago. It's alarming how often I would walk around and see a post it note stuck to their monitor labelled.. my password! It was certainly a welcome change for our staff. Nothing worse than teachers emailing me in the summer when they forgot what they changed it to either! Good job I don't forget my password hey!

[klop]

I moved away from it a couple of years ago. It's alarming how often I would walk around and see a post it note stuck to their monitor labelled.. my password! It was certainly a welcome change for our staff. Nothing worse than teachers emailing me in the summer when they forgot what they changed it to either! Good job I don't forget my password hey!

 

I'm guessing you have faith and trust in your colleagues to use strong passwords... and to let you know if they feel it is compromised and needs to be changed.

 

Unfortunately I do not have any faith or trust - complexity is not activated here at present and many of the passwords I see are very weak. One member of staff has our town name as a password (it's changed now) and couldn't see why this wasn't secure for O365. Others have their children's name or perhaps the month name maybe followed by a number and that is it. The school policy states passwords should be strong and gives examples - which is simply not followed.

 

To be honest I'm tired of the moaning here relating to passwords - either resulting from me suggesting someone's isn't strong enough or the groan that they have to be changed - which was dictated to us during an audit sometime back.

 

So.. once and for all I want a decision from the SLT and I will put that in place. Staff will still moan at me regardless - but maybe I'm past caring!

[Primus]

I'm guessing you have faith and trust in your colleagues to use strong passwords... and to let you know if they feel it is compromised and needs to be changed.

 

Unfortunately I do not have any faith or trust - complexity is not activated here at present and many of the passwords I see are very weak. One member of staff has our town name as a password (it's changed now) and couldn't see why this wasn't secure for O365. Others have their children's name or perhaps the month name maybe followed by a number and that is it. The school policy states passwords should be strong and gives examples - which is simply not followed.

 

To be honest I'm tired of the moaning here relating to passwords - either resulting from me suggesting someone's isn't strong enough or the groan that they have to be changed - which was dictated to us during an audit sometime back.

 

So.. once and for all I want a decision from the SLT and I will put that in place. Staff will still moan at me regardless - but maybe I'm past caring!

 

And making them change their password every 40 days helps with this how?!

[klop]

And making them change their password every 40 days helps with this how?!

 

It doesn't - that is the realisation... at least not without other factors included.

 

What would make for a secure password is staff acceptance that a password should be secure.

 

We were instructed to set the password change during an audit - and previous members of the SLT (who have now left) were insistent that we kept it.

I am hoping to enforce complexity and perhaps retain the password life to 90 days (from 42 I believe) - however I am still waiting for a reply.

[Primus]

It doesn't - that is the realisation... at least not without other factors included.

 

What would make for a secure password is staff acceptance that a password should be secure.

 

We were instructed to set the password change during an audit - and previous members of the SLT (who have now left) were insistent that we kept it.

I am hoping to enforce complexity and perhaps retain the password life to 90 days (from 42 I believe) - however I am still waiting for a reply.

 

I don't understand why you'd retain the password expiry policy when your experience and the professional guidance indicates it's flawed?

[klop]

I don't understand why you'd retain the password expiry policy when your experience and the professional guidance indicates it's flawed?

 

If we were do not force complexity into staff passwords I would prefer that we continued with the password expiry - at least something is then in place. Having read much professional guidance on using the expiry policy it states adding other options to secure - options that we do not have currently in place.

 

However, it is hopefully under discussion. But if staff are unable to keep their passwords secure themselves, whether it is changed regularly or not it may be considered that they must be changed just to try to keep them from being known by others. If staff will not (and do not) choose complex passwords by choice and we choose not to force them - then other options need to be considered - what would you do?

 

If you know that staff are sharing their passwords and never changing them then wouldn't you consider that to be unsecure?

 

Additionally we have at least one member of staff who does have fixed passwords for other logins and does still write those passwords down in their special password book - not secure either really!?

 

Basically - you cannot win - at least not in at place!

[Primus]

Obviously without support from above (SLT) you're fighting a losing battle.

 

Ideally you'd have complexity enforced, a reasonable length (8+ characters) and no expiry.

 

This is a behavioural issue with staff that can only be solved with the support of SLT.

 

Sometimes you find that by explaining the issues, the compromises you've made (eg. removing the need to change constantly) and treating people like adults they might respond (they might not I don't know your staff!)

 

If it were me then having to change my password every 40 days would massively annoy me and lead to me choosing weak passwords so that I could remember them!