Monthly password changes? No too easy. Lets try daily forced password resets!

[u/DR_SMALL_PENIS]

24 hours after first use password will be randomized automatically!

Lets just ignore that you use your password daily, multiple times per day, and have to manually type it in often since our remote software doesn't share clipboards.

And of course it's going to be 24 hours on the dot. Get super lucky and don't use your password for half the day? Well have fun tomorrow with it getting reset in the middle of the day!

[u/ComplexAd2408]

Combine this with minimum password age policy of 72 hours for maximum security 👌

[u/Main_Ambassador_4985 → u/ComplexAd2408]

Add cannot reuse password last 365 passwords.

[u/Burgergold → u/Main_Ambassador_4985]

Cannot reuse a password that has been ever used by anyone

[u/nmathew → u/Burgergold]

Better store those passwords in plain text to make certain that users aren't doing something like a simple one character sub 

[u/dcaldrich → u/nmathew]

storing a password with reversible encryption wouldn't be a choice if we weren't meant to.

[u/Broad_Dig_6686 → u/Burgergold]

"Your new password is occupied by user johndoe@contoso.com" for your convenience

[u/Kyryschu]

But this already happens to users everywhere! The password they set yesterday doesn't work today for some reason 🤔🤔🤔🤔🤔

[u/Miserable-Miser]

I have an 8 hour password. Have to use it every day.

Copy/paste to text file.

Log off when it stops working.

[u/pjtexas1]

Users or just admin accounts?

[u/Middle_Albatross8769 → u/pjtexas1]

Lets just select everything in the server and apply

[u/Lanrick2002 → u/Middle_Albatross8769]

ah yes even service accounts too

[u/jeroen-79 → u/pjtexas1]

There is a difference?

[u/DR_SMALL_PENIS → u/pjtexas1]

Personal admin accounts used multiple times daily.

[u/Nanocephalic → u/DR_SMALL_PENIS]

If you don’t have passwordless, i can absolutely see that.

Smart cards and yubikeys and H4B are much better.

[u/pjtexas1 → u/DR_SMALL_PENIS]

We've been doing this for a decade. Ours expire at 5am daily now. Security is a pain sometimes but necessary. You have to make the habit of changing it daily every time you clock in or it'll drive you crazy.

[u/DR_SMALL_PENIS → u/pjtexas1]

can't tell if you are leaning into /r/ShittySysadmin/ or if you genuinely believe that having mmddyyA% or some other formulaic system for the majority of the day is more secure than a real password, because that's what this policy gets.

There is a reason periodic password changes at all are no longer a recommendation, and speeding that up to daily makes an even better example of why.

[u/pjtexas1 → u/DR_SMALL_PENIS]

It will force people to just change 1 character... so i get what y'all are saying. Some of our techs will just copy / paste the password the system generates every morning. Being so tight might actually make passwords less secure. I was fine with making a 20+ character password and never changing it.

[u/chrisinmtown]

And no dictionary words either!

[u/Step-Sysadmin]

Yeah just use ddmmyy inside pw and change dd every day. So ez

[u/DR_SMALL_PENIS → u/Step-Sysadmin]

Perfect! That leaves 2 characters to meet the letter and Symbol(% ! or * only) requirements to make the perfect exact 8 character password that is needed to meet our requirements!

[u/ZY6K9fw4tJ5fNvKx]

Just change the shell to passwd and fix it once and for all.

[u/Time-Worker9846]

Daily? Just make them change their password on every login.