Do Not Expire Passwords

[aac]

Hi All

 

Just wondering what everyone else's view is on Microsoft's change of advice back in 2019 no longer enforce password expiry? We have our user accounts synced to Microsoft 365 using Azure AD connect and it is not clear if the advice is to no longer enforce expiry just for cloud accounts or on the local network as well or at least I can't find anything definitive. Major downside I can see isthe lack of MFA on the local network. Am quite surprised I cannot find a previous discussion on this topic here on Edugeek...

[jthompson]

I think that guidance from Microsoft will be along the same lines as from the security community more broadly, in that you do away with regular forced password changes to allow users to more easily adopt long passwords. Increasing the minimum password length is the name of the game, and having regular forced changes will undermine that effort by encouraging poor user habits.

 

Personally, I still think having a max password age has some merit for on-prem accounts without any MFA, although that's measured in years rather than weeks or months.

 

This thread might be worth a read through

[andy_b]

Always found password expiry wasn't that great - seemed to encourage people to use weaker passwords that were easier to increment.

 

https://www.ncsc.gov.uk/collection/passwords/updating-your-approach

 

Don't enforce regular password expiry

 

Regular password changing harms rather than improves security. Many systems will force users to change their password at regular intervals, typically every 30, 60 or 90 days. This imposes burdens on the user and there are costs associated with recovering accounts.

 

Forcing password expiry carries no real benefits because:

 

the user is likely to choose new passwords that are only minor variations of the old

stolen passwords are generally exploited immediately

resetting the password gives you no information about whether a compromise has occurred

an attacker with access to the account will probably also receive the request to reset the password

if compromised via insecure storage, the attacker will be able to find the new password in the same place

[aac]

Trying to guage what others are doing currently. Are you gentleman still enforcing expiry locally or decided to turn off?

[mavhc]

Don't expire your passwords, check if they're terrible (they've been leaked, or they're so simple you can crack them)

[TechMonkey]

Trying to guage what others are doing currently. Are you gentleman still enforcing expiry locally or decided to turn off?

 

Not expiring our passwords. Set complexity rules and encourage long passwords. A single, unique, complex password is much better than an easy password with a number that increments, which, lets be honest, is what staff will inevitably do.

[EssentialRug]

Trying to guage what others are doing currently. Are you gentleman still enforcing expiry locally or decided to turn off?

* and gentlewomen.

 

We don't ask users to change passwords periodically for the reasons linked above.

[timbo343]

The guidance has very much changed in the last couple of years and we have had to adapt.

 

NCSC do say use 3 different words, min 16 characters and dont expire.

 

We use Specops password auditor to audit our Domain passwords.

 

The thing is it would be great if MS could build in a breach checker instead of paying a fortune for 3rd parties.

 

Just digressing a bit, the new MS licensing model is a bit.. interesting in terms the "light users" who dont fall under the EQU have to be licensed additionally to receive 2FA. Doesn't make sense to me!

Edited February 10, 2023 by timbo343

[Cw2k]

 

The thing is it would be great if MS could build in a breach checker instead of paying a fortune for 3rd parties.

 

 

If you have Azure AD P1 you can make use of Azure Ad Password Prection on prem which blocks both passwords in Microsoft global banned list and let’s you add custom base terms, handy to prevent users using company name or variant in their password and also stops them using their username as their password (they do try). It applies to all accounts so if you have weaker passwords for students based on something weak like dob they will get blocked, can be run in audit mode to identify users using weak passwords, it logs which list (Microsoft or custom) that the password came from.

[mavhc]

Don't need to pay: https://blog.lithnet.io/2019/01/lppad-1.html

[timbo343]

Don't need to pay: https://blog.lithnet.io/2019/01/lppad-1.html

Thanks, will have to have a look at this.

[fiza]

In AD we have always had 8 character passwords. To encourage longer passwords what is the easiest way to move from minimum 8 character passwords to minimum 12? Do we have to force users to change passwords in one go? Can we set a password change to a 12 character one at next password change?

[timbo343]

In AD we have always had 8 character passwords. To encourage longer passwords what is the easiest way to move from minimum 8 character passwords to minimum 12? Do we have to force users to change passwords in one go? Can we set a password change to a 12 character one at next password change?

 

Could you set up Fine Grained Passwords so that you could do it group by group and assign minimum password requirements that way. Set a new policy or change an existing policy so that anyone who changes with password will be forced to meet the new requirements.

[timbo343]

Don't need to pay: https://blog.lithnet.io/2019/01/lppad-1.html

 

Would it be possible to apply this to a group of users? For example staff accounts first even though it's based on Computer Configuration Policies? I presume it's just a case Security Filtering in Group Policy and take out Authenticated Users and populate with the group of users we want to test this against.

[mavhc]

You can set a new rule, and then selectively expire people's passwords, forcing them to reset to new standard