Article ID: 161990 - View products that this article applies to.
This article was previously published under Q161990
Microsoft Windows NT 4.0 Service Pack 2 introduces a new DLL file (Passfilt.dll) that lets you enforce stronger password requirements for users. Passfilt.dll provides enhanced security against "password guessing" or "dictionary attacks" by outside intruders.
NOTE: While Windows 95 does not support case-sensitivity in its passwords, the password change request is sent to the Primary Domain Controller (PDC)in such a way that it can enforce the password filtering rules. For example, if you change your domain password on a computer running Windows 95 to PassWord1, you can use password1, PASSWORD1, PassWord1, and so on to log on to the domain from a computer running Windows 95. However, you must use PassWord1 to log on to a computer running Windows NT.
NOTE: Passwords changed in Windows 3.x or Windows for Workgroups 3.x cannot be enforced in this password policy.
The Passfilt.dll file implements the following password policy:
How to Install Strong Password FilteringImportant This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/322756/ )How to back up and restore the registry in Windows
To ensure Strong Password functionality occurs throughout your domain structure, make the following changes on all primary domain controllers (or stand-alone servers, where needed).
Passfilt.dll is not necessary on backup domain controllers since the PDC is the only machine where changes to the domain accounts database are made. However, it should be installed on all BDCs because they can be promoted to PDC. If a BDC without Passfilt.dll is promoted to PDC, then strong password enforcement will be lost but there will be no other adverse effects.
(http://support.microsoft.com/kb/174075/ )Strong passwords with Passfilt.dll are not enforced
(http://support.microsoft.com/kb/174076/ )Invalid password message when strong passwords are required
Microsoft Windows 2000
Strong Password Functionality Included with Microsoft Windows 2000The functionality described above for the Passfilt.dll file for Windows NT 4.0 has been included in the operating system security components for Windows 2000. You can enable strong password enforcement in Windows 2000 by starting the Local Computer Policy snap-in and enabling the Passwords must meet complexity requirements setting in Computer Configuration\Windows Settings\Security Settings\AccountPolicies\Password Policy.