Skip to main content This browser is no longer supported. Show Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. Enforce password history
In this articleApplies to
Describes the best practices, location, values, policy management, and security considerations for the Enforce password history security policy setting. ReferenceThe Enforce password history policy setting determines the number of unique new passwords that must be associated with a user account before an old password can be reused. Password reuse is an important concern in any organization. Many users want to reuse the same password for their account over a long period of time. The longer the same password is used for a particular account, the greater the chance that an attacker will be able to determine the password through brute force attacks. If users are required to change their password, but they can reuse an old password, the effectiveness of a good password policy is greatly reduced. Specifying a low number for Enforce password history allows users to continually use the same small number of passwords repeatedly. If you don't also set Minimum password age, users can change their password as many times in a row as necessary to reuse their original password. Possible values
Best practices
LocationComputer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Default valuesThe following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
Policy managementThis section describes features, tools, and guidance to help you manage this policy. Restart requirementNone. Changes to this policy become effective without a device restart when they're saved locally or distributed through Group Policy. Security considerationsThis section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. VulnerabilityThe longer a user uses the same password, the greater the chance that an attacker can determine the password through brute force attacks. Also, any accounts that may have been compromised remain exploitable for as long as the password is left unchanged. If password changes are required but password reuse isn't prevented, or if users continually reuse a few passwords, the effectiveness of a good password policy is greatly reduced. If you specify a low number for this policy setting, users can use the same small number of passwords repeatedly. If you don't also configure the Minimum password age policy setting, users might repeatedly change their passwords until they can reuse their original password.
CountermeasureConfigure the Enforce password history policy setting to 24 (the maximum setting) to help minimize the number of vulnerabilities that are caused by password reuse. For this policy setting to be effective, you should also configure effective values for the Minimum password age and Maximum password age policy settings. Potential impactThe major impact of configuring the Enforce password history setting to 24 is that users must create a new password every time they're required to change their old one. If users are required to change their passwords to new unique values, there's an increased risk of users who write their passwords somewhere so that they don't forget them. Another risk is that users may create passwords that change incrementally (for example, password01, password02, and so on) to facilitate memorization, but these passwords make it easier for an attacker to guess. Also, an excessively low value for the Maximum password age policy setting is likely to increase administrative overhead because users who forget their passwords might ask the Help Desk to reset them frequently.
FeedbackSubmit and view feedback for |