Managing Credentials

Authentication is an organization s first defense against malicious intruders. As a result, many organizations have implemented stringent validation criteria, including strong passwords and smart cards.

Passwords can be the weakest link in a computer security scheme. Network passwords that once took weeks to break can now be broken in hours. However, it still can take months to crack a strong password. A strong password that is hard to break has the following characteristics:

• Contains at least six characters.

• Contains characters from each of the following three groups:

  • Uppercase and lowercase letters (A, a, B, b, C, c, and so on)

  • Numerals

  • Symbols (characters that are not defined as letters or numerals, such as !, @, #, and so on)

• Contains at least one symbol character in the second through sixth positions.

• Is significantly different from prior passwords.

• Does not contain your name or user name.

• Is not a common word or name.

Windows XP Professional passwords can have up to 127 characters. However, if you use Windows XP Professional on a network that also has computers using Windows 95 or Windows 98, consider using passwords no longer than 14 characters. If your password is longer, you might not be able to log on to your network from those computers.

Warning 

Require users to change passwords frequently. Although a strong password can help protect against intruders, given enough time, automated password-cracking tools can crack any password. Changing passwords can minimize the risk of an intruder determining a password. It also minimizes potential damage when a password is compromised without the user s knowledge.

Blank Password Restrictions

By default, Windows XP Professional does not require users with local accounts, including administrators, to have passwords. Users can choose to set passwords on their own accounts, or administrators can assign passwords to users on a local computer.

To protect users who do not password-protect their accounts, Windows XP Professional accounts without passwords can only be used to log on at the physical computer console. By default, accounts with blank passwords can no longer be used to log on to the computer remotely over the network, or for any other logon activity except at the main physical console logon screen. For example, you cannot use the secondary logon service (RunAs) to start a program as a local user with a blank password.

Caution 

If your computer is not in a physically secured location, it is recommended that you assign passwords to all local user accounts. Failure to do so allows anyone with physical access to the computer to log on using an account that does not have a password. This is especially important for portable computers, which should always have strong passwords on all local user accounts.

Assigning a password to a local account removes the restriction that prevents logging on over a network and permits that account to access any resources it is authorized to access, even over a network connection.

Note 

This restriction does not apply to domain accounts. It also does not apply to the local Guest account. If the guest account is enabled and has a blank password, it will be permitted to log on and access any resource authorized for access by the Guest account. For more information about managing network logons using the Guest account, see Authorization and Access Control in this book.

If you want to disable the restriction against logging on to the network without a password, you can do so through Local Security Policy. The policy setting that controls blank password restriction can be modified using the Local Security Policy or Group Policy MMC snap-ins. You can use either tool to find this policy option at Security Settings\Local Policies\Security Options. The name of the policy is Accounts: Limit local account use of blank passwords to console logon only. It is enabled by default.

Caution 

Disabling this policy setting might degrade the security of your Windows XP Professional computer. Before disabling this policy setting, ensure that all local accounts have strong passwords, or that the computer is in a secure and trusted environment where it will not be subject to attack.

Password Management

You can use User Accounts in Control Panel or the Local Users and Groups MMC snap-in to add and remove local user accounts, add and remove users from groups, and work with passwords. When the Windows XP Professional based computer is connected to a Windows NT or Windows 2000 Server domain, you can use Local Users and Groups to add and remove domain user accounts to local groups. When the Windows XP Professional based computer is not connected to a domain, you can use User Accounts to add and remove local user accounts and assign users to a local group.

To change the password for a user

1. In Control Panel, open User Accounts. In the User Accounts dialog box, click the user s name, and then click Reset Password.

2. Enter the new password twice in the Reset Password dialog box.

3. If desired, type in a word or phrase in the box provided for password hints.

To perform advanced password-related tasks

1. In the Local Users and Groups MMC snap-in, double-click the Users folder.

2. Select and right-click the name of the user who has a local account that you want to manage, and then select Properties.

3. On the user s Properties page, select one or more of the following options:

   • User must change password at next logon.

   • User cannot change password.

   • Password never expires.

   • Account is disabled.

   • Account is locked out.

Group Policy

You can use Group Policy to perform more advanced password management tasks, such as setting a minimum password length or the interval between password changes. When you review your password security policies, establish your Account Lockout Policy at the same time. This policy locks a user account after a certain number of incorrect passwords are tried in succession. For more information about password-related policy options, see Account Policies later in this chapter.

Note 

You must log on as an administrator or be a member of the Administrators group to add and delete user accounts, assign users to a local group, and set or change user passwords.

Stored User Names and Passwords

It is not always desirable to use one set of credentials for access to different resources. For example, when an administrator accesses a remote server, you might want him or her to use administrative rather than user credentials. Similarly, if a user will be accessing external resources such as a bank account, you might prefer that he or she use credentials that are different than their network username and password.

Stored User Names and Passwords in Control Panel simplifies the management and use of multiple sets of logon credentials, including X.509 certificates used with smart cards and Passport credentials. The credentials part of the user s profile are stored until needed. This can increase security on a per-resource basis by ensuring that if one password is compromised it does not compromise all security.

Note 

Microsoft Passport provides a single name, password, and wallet that can be used on multiple Web sites.

After a user logs on and attempts to access additional password-protected resources, such as a share on a server, and if the user s default logon credentials are not sufficient to gain access, then Stored User Names and Passwords is queried. If alternate credentials with the correct logon information have been saved in Stored User Names and Passwords, these credentials are used to gain access. Otherwise, the user is prompted to supply new credentials, which can then be saved for reuse, either later in the logon session or during a subsequent session.

Several restrictions apply:

• If Stored User Names and Passwords contains invalid or incorrect credentials for a specific resource, access to the resource will be denied, and the Stored User Names and Passwords dialog box will not appear.

• Stored User Names and Passwords stores credentials only for NTLM, Kerberos, Passport, and SSL authentication. Microsoft Internet Explorer maintains its own cache for basic authentication.

These credentials become an encrypted part of a user s local profile in the \Documents and Settings\Username\Application Data\Microsoft\Credentials directory. As a result, these credentials can roam with the user if the user s network policy supports Roaming Profiles. However, if you have copies of Stored User Names and Passwords on two different computers and change the credentials that are associated with the resource on one of these computers, the change will not be propagated to Stored User Names and Passwords on the second computer.

To store a new user name and password

1. In Control Panel, open User Accounts.

2. On computers joined to a domain, click the Advanced tab, click Manage Passwords.

   or

   On computers not joined to a domain, click the icon that represents your user account, and then, under Related Tasks, click Manage your stored passwords.

3. Click Add.

4. Type the appropriate information in the spaces provided.

   Warning 

   Educate your users about the importance of using strong passwords for all credentials stored in Stored User Names and Passwords.

To store a Passport ID

1. In Control Panel, open User Accounts.

2. On computers not joined to a domain, click the icon that represents your user account, and then, under What do you want to change about your account?, click Create a Passport.

   or

   On computers joined to a domain, click the Advanced tab, then click .NET Passport Wizard.

3. Type the appropriate information in the spaces provided.

4. In the When accessing box, type *.passport.com.

   Warning 

   Some credentials are used infrequently. Others might be for extremely sensitive resources that the user wants to protect more carefully. When appropriate, have users store credentials for This logon session only. Credentials for a single logon session are typically stored by selecting the appropriate check box in the User Names and Password dialog box.

Some administrators might not feel comfortable with allowing users to store network credentials for later use. This might be due to concern about reduced security, or a potential increase in the number of account lockouts when credentials stored in User Names and Passwords expire. As a result, a Group Policy setting has been introduced to allow you to limit use of Stored User Names and Passwords.

To limit use of Stored User Names and Passwords

1. In the Group Policy MMC snap-in, double-click the Security Options folder (Computer Configuration\Windows Settings\Security Settings\Local Policies\ Security Options).

2. Right-click Network access: Do not allow storage of credentials or .NET Passports for network authentication.

3. Click Enabled, and then click OK.