Using Group Policy to enforce a password policy

In most networks, your password is the only thing that lies between a hacker and access to your network. People will choose bad passwords if we let them. We know this – that's why a lot of websites and companies have password policies such as this: A minimum of 8 characters, one uppercase letter, one lowercase letter, one special character, and you have to change your password every month. However, modern research tells us that password policies like this are actually detrimental – they force users into creating passwords that are difficult for humans to remember, but are easy for computers to guess.

The best current practices around what constitutes a good password policy changes from time to time, and it is currently different to the default Windows policy. So, let's have a look at how we can change the password policy so that if best current practices change again in the future, we can keep up with the times...