Version for print

How do I enable strong password filtering?

Windows NT 4.0 Service Pack 2 introduced a new password filter, passfilt.dll, which implements the following new restrictions

• Passwords must be at least 6 characters long
• Passwords must meet at least 3 of the following criteria
  - Uppercase letters A-Z
  - Lowercase letters a-z
  - Number(s) 0-9
  - Non-alphanumeric character (e.g. !, etc.)
• Password may not contain your user name or any part of your full name

To enable this functionality perform the following on all PDC's (and stand alone's if used). You do not need to install this on BDC's, however you should in case the BDC is promoted to a PDC.

1. Start the registry editor (regedt32.exe, do not use regedit.exe)
2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
3. Double click on "Notification Packages"
4. Add PASSFILT on a new line (there may be a FPNWCLNT so you should add this after this value). Click OK
5. Close the registry editor
6. Reboot the machine

It should be noted you will still be able to set passwords in User Manager that do not meet the criteria, this is by design as direct SAM updates are not filtered.

Security FAQ

Windows Privacy Tools - http//www.privacywindows.com