Passwords form the first line of defense against unauthorized access to ensure your organization’s security. However, using strong passwords is often underestimated and ignored. Windows operating systems have complex password policies that, when activated, will warn you and force you to use complex passwords when you try to enter simple ones. While current password cracking programs can break passwords with sufficient time, guessing, and trial methods, breaking a simple password is not difficult at all.
Breaking strong passwords is more difficult and time-consuming compared to breaking simple passwords.
To enable password complexity, you can follow these steps on your own computer, or in a domain environment, create a new group policy to activate it.
Start/Run/gpedit.msc
From the screen that appears Computer Configuration/Windows Settings/Security Settings/Account Policies/
Enforce password history: This section sets how many previous passwords should be remembered. Here, you cannot reuse your last 3 passwords.
Maximum password age: You can set how many days until your password expires from this field. For example, according to my settings, I need to change my password after 72 days
Minimum password age: After changing my password, how many days must pass before I can change it again. In my example, 2 days must pass before I can change my password again
Minimum password length: Specifies the minimum required password length.
Password must meet complexity requirements: This activates the password complexity policy, which is the subject of our article. It prevents you from entering simple passwords to ensure your passwords are more secure.
Store password using reversible encryption: This option helps store your passwords encrypted in a reversible way.
What makes a weak password?
- Leaving the password blank
- Sticking your password to the monitor
- Contains your username, real name, or company name
- Contains a simple phrase like “Password”
What should a strong password be like?
- At least 7 characters long
- Your password should not be stuck to the monitor
- Does not contain your username, real name, or company name
- Does not contain a simple phrase
- Each password should be different. For example: PassWord1, password2, Password3 – incrementing passwords like this is not considered strong.
| Group | Example |
| Uppercase characters | A, B, C … etc. |
| Lowercase characters | a, b, c … etc. |
| Numbers | 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 |
| Symbols | ` ~ ! @ # $ % ^ & * ( ) _ + – = { } | : ” ; ‘ < > ? , . / |
An example of a strong password: !(D@Vut> & <)
Some passwords may appear strong but actually aren’t. While Merhaba2U! seems to meet all criteria, it’s easy to crack. Instead, using something like 5@na Merhq6@! would create a strong password. Additionally, using ASCII characters will help you create a strong password. (kUµ!¶0o and Wf©$0k#»g¤5ªrd.)
It should be remembered that Windows allows passwords up to 127 characters in length. In Windows 98 and earlier versions, this limit is 14 characters. If you have Windows 98 in your environment, you won’t be able to log in with passwords longer than 14 characters.
Hoping you create strong passwords
Reference: http://technet.microsoft.com/en-us/library/cc756109%28v=ws.10%29.aspx
