Take the 2-minute tour ×

We recently enabled password complexity requirements in our company and I noticed that users already having complex passwords weren't forced to change their password but everyone else was required to.

Now the question is how does AD confirm password complexity when reversible encryption is not enabled? The only way I can think of is to set a policy/flag to do the check for password complexity client-side when the user tries to log in. If the "client machine" notices that the password being used is valid but not complex it initiates the password change procedure.

Can anyone confirm or shed some more light on this?

PS. In our case the AD infrastructure is based on Windows Server 2003 but if there any difference in the way this is done on 2008/R2 info on that is also appreciated.

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

According to Microsoft, password complexity requirements are enforced on password change or creation, not on login. So, I guess the answer to your question is that it doesn't check password complexity at login, and can't check password complexity at login, even.

Is it possible these users with weak passwords were forced to change their password for another reason?

First thing that comes to my mind is that the new password policy in your domain might also have included password expiry, which would hit the users who've used password1 as a password since the beginning of time, but the more responsible users, who had "complex" passwords also may have good habits and change their passwords periodically, and as a result would not have been prompted to change their passwords.

Anyway, the Technet forums also have similar questions, and the answers over there are also that enforcing password complexity won't force users with weak passwords to change their passwords in an of itself. They use the same Technet article I linked as a source, for what that's worth, though all my experience with Active Directory lines up with that article. If you want to enforce password complexity, you should probably add password expiry and/or force users to change their passwords at next login, or they'll go on using the same 3 character password they always have, because nothing's forcing them to change it.

share|improve this answer
Not completely related, but Samba-based domains behave the same way: the only time you can enforce password complexity is when user changes password. –  Hubert Kario Oct 1 '12 at 7:43
Little more detail at at link. Agree that something must have forced users to change their password, I did a migration between forests with differing complexity requirements. The source did not have complexity switched on, the target did. In that scenario clients (XP) were not prompted to reset their passwords. What version are your clients? –  downthepub Oct 1 '12 at 11:58
I'll have to dig a bit deeper into what actually happened. There is a high probability that the policy was just announced and not really automatically "enforced". This answer makes sense as logically if you don't know the cleartext password you can't check for complexity at any point. I'll just confirm the exact details and update here. The clients in my case are a mix of Windows 7 and XP (80% or more are XP) –  Fahad Yousuf Oct 2 '12 at 3:46
I just confirmed with our exchange admin that the policy applied was to force password changes for users with passwords older than 6 months. They just added the complexity requirements on top of that. –  Fahad Yousuf Oct 2 '12 at 13:28
add comment

Your Answer


