How to enable strong password functionality in Windows NT

MORE INFORMATION

The Passfilt.dll file implements the following password policy:

1. Passwords must be at least six (6) characters long.
2. Passwords must contain characters from at least three (3) of the following four (4) classes:

         Description                     Examples
         -----------------------------------------------
   
         Upper case letters              A, B, C, ... Z
         Lower case letters              a, b, c, ... z
         Westernized Arabic numerals     0, 1, 2, ... 9
         Non-alphanumeric ("special 
           characters") such as 
           punctuation symbols
   

3. Passwords may not contain your user name or any part of your full name.

These requirements are hard-coded in the Passfilt.dll file and cannot be changed through the user interface or registry. If you wish to raise or lower these requirements, you must write your own .dll and implement it in the same fashion as the Microsoft version that is available with Windows NT 4.0 Service Pack 2.

How to Install Strong Password Filtering

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To ensure Strong Password functionality occurs throughout your domain structure, make the following changes on all primary domain controllers (or stand-alone servers, where needed).

Passfilt.dll is not necessary on backup domain controllers since the PDC is the only machine where changes to the domain accounts database are made. However, it should be installed on all BDCs because they can be promoted to PDC. If a BDC without Passfilt.dll is promoted to PDC, then strong password enforcement will be lost but there will be no other adverse effects.

1. Install the latest Windows NT 4.0 service pack.
2. Copy Passfilt.dll to the %SYSTEMROOT%\SYSTEM32 folder.
3. Start Registry Editor (Regedt32.exe).
4. Locate and click the following key in the registry:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

5. If there is not a value called Notification Packages, then on the Edit menu click Add Value, and then add the following Value:

   Notification Packages

   This value should be a data type of REG_MULTI_SZ.
   
   NOTE: If the Notification Packages value already exists, proceed to the next step.
6. Double-lick the Notification Packages value.
7. In the Data section there should be a value of FPNWCLNT. Create a new line, and then type PASSFILT.
8. Quit Registry Editor.
9. Restart the computer.

For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

Microsoft Windows 2000

Strong Password Functionality Included with Microsoft Windows 2000

The functionality described above for the Passfilt.dll file for Windows NT 4.0 has been included in the operating system security components for Windows 2000. You can enable strong password enforcement in Windows 2000 by starting the Local Computer Policy snap-in and enabling the Passwords must meet complexity requirements setting in Computer Configuration\Windows Settings\Security Settings\AccountPolicies\Password Policy.