login password policies

[mrstrong]

Hi,

just wondering how people approach this. We use office 365 which enforces strong passwords

but we also have separate active directory logins to the domain. Some of these passwords

are very weak. I know a fair few of them which can be helpful e.g. if I need to login to a teacher

PC.

 

So how do you do it? E.g. do you enforce strong passwords and regular password changes

and if so how do you manage logging in as the teacher on their PC in order to troubleshoot etc.

Edited May 21, 2020 by mrstrong
typo

[Steve21]

You get the teacher to log on for you. No reason to be logging in as another teacher without their knowledge anyway That's why we have test-teacher accounts etc

 

Steve

[mavhc]

Don't have 2 passwords, that's just confusing, sync them and auto login with Seamless SSO. Then if they have their own laptops they can setup pins and fingerprints. Pins are MS's solution to needing a way more complex PW online than offline because the attack surface of an online account is 510.1 million km²

[Davit2005]

Hi,

just wondering how people approach this. We use office 365 which enforces strong passwords

but we also have separate active directory logins to the domain. Some of these passwords

are very weak. I know a fair few of them which can be helpful e.g. if I need to login to a teacher

PC.

 

So how do you do it? E.g. do you enforce strong passwords and regular password changes

and if so how do you manage logging in as the teacher on their PC in order to troubleshoot etc.

 

I wouldn't suggest logging in as another actual user, ask them to show you the problem, take a picture, you could check the event logs, etc.

 

There is no need to have different passwords, Azure AD Connect (used to be DirSync) solves that and is fairly easy to implement. Microsoft have a dedicated team to help, or at least used to.

Edited May 21, 2020 by Davit2005

[psydii]

+1 for Azure AD Connect. We also use this:

 

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises

 

We enforce password length using on premises policy, and use Azure AD to ensure sufficiently hard to guess/brute-force password.

[paulkerton]

Don't have 2 passwords, that's just confusing, sync them and auto login with Seamless SSO.

Is the right answer.

Though if there are any costs, and you have some of the SLT's I've had in the past, 2 passwords it is!

What do you mean it'll cost more in wages to manage it?

[mrstrong]

Don't have 2 passwords, that's just confusing, sync them and auto login with Seamless SSO. Then if they have their own laptops they can setup pins and fingerprints. Pins are MS's solution to needing a way more complex PW online than offline because the attack surface of an online account is 510.1 million km²

 

do you mean use Azure AD Connect ? https://docs.microsoft.com/en-us/office365/enterprise/deploy-office-365-directory-synchronization-dirsync-in-microsoft-azure

 

also do you have to move to azure in one big bang or can you phase it e.g. just do for a test OU. If it's big bang one way no going back I think I'd want

to run it in a test env first. How would you do that, spin up a few vms?

Edited May 21, 2020 by mrstrong
added extra info

[HPlum78]

If you are using O365 then you are already using Azure AD as this essentually underpins your O365 tenant and no the very idea is that you take the cloud that you need when you need.

 

Using password hash sync into Azure is a good step as MS know how to spot hashes that are known to be compromised and other dodgy things that are happing out there in the wild. More than you will ever be able to do in your own bubble.

[mavhc]

AzureAD Connect has no costs, once you want to get rid of Windows Server then you have to pay, but the first hit is free. Best to go in stages, Sync accounts, move files to sharepoint, switch to cloud management over GPO, etc etc

[Davit2005]

do you mean use Azure AD Connect ? https://docs.microsoft.com/en-us/office365/enterprise/deploy-office-365-directory-synchronization-dirsync-in-microsoft-azure

 

also do you have to move to azure in one big bang or can you phase it e.g. just do for a test OU. If it's big bang one way no going back I think I'd want

to run it in a test env first. How would you do that, spin up a few vms?

 

 

To sync users to Office 365 you just need to install Azure AD Sync on a server, I highly suggest installing on a member server not a Active Directory controller. I believe you can just sync OUs, it's been a long time since I used it as no longer have that role.

 

 

The only other thing you may need to do is change the UPN of the users (99% should not cause any issue but test) and make sure that the O365 address is the main SMTP address of the users.

 

I'm still bit uncertain into the whole cloud bit, how it works with managed devices. After 15+ years of GPO's it is a bit of a new concept to me, lol, but it is certainly something to consider. Anyone got any decent info on that note???

Edited May 21, 2020 by Davit2005

[mavhc]

no spaces in usernames, and add the public domain to your AD domain list