Length-based Password Aging

Hey, it’s me again. As I’m very fascinated of this project, I got an idea for the length-based complexity rules. I thought about an option, where you could set different password ages. (count of days, after which the password has to be changed)

That could be a great opportunity to allow people to still use smaller passwords, but also restricting them by letting their passwords expire faster.

To make this real, maybe the attribute “PwdLastSet” could be used, for example to be set a month before the actual change date. In my understanding, the password would then expire a month earlier.

$ReplaceHashTable = New-Object hashtable
$date = (Get-Date "16.05.2020").ToFileTime()  #Windows NT Time Format
$ReplaceHashTable.Add("PwdLastSet", $date)

Set-ADUser -Identity Dave -Replace $ReplaceHashTable

I tried this powershell commands, but it seems, that this attribute can be changed only to 0 or -1 from an admin. 0 => Password expires now -1 => Password expires never

A system user may be able to change the attribute. Maybe the service of LPP is also able to do this.

[ryannewington]

@ToxicDave it will stay open as a feature request. I’m working on a new product at the moment, and hope to return to v2 of LPP soon. I’ll look at options then.

[Techie4Life83]

Why not just use Fine Grain Password Policies? Isn’t this kind of what you are doing already with having different requirements for different lengths of passwords? https://www.lepide.com/blog/fine-grained-password-policy-best-practices/#:~:text=AD supports one set of,a separate domain for them.

Create the criteria in Lithnet, have Lithnet create the appropriate FGPPs and corresponding AD groups. Then when a user submits their password you would remove them from all of the FGPP shadow groups and add them to the appropriate one for the password they put in. Submit their password to AD after that and BOOM variable length password expiration.