topic nFront has a solution (shows in Network Access Control

Enforce Password Complexity on Microsoft Active Directory

Mohamed_Abdelbaky1 — Mon, 11 Mar 2019 06:22:48 GMT

Hi All,

Given that Microsoft Active Directory has two limitations as follows:

Cannot reject specific word to be used in Password Reset (e.g. company name)
Cannot enforce Special Characters as Mandatory Complexity requirements (i.e. AD can accept the password if user submit on the following complexity "Upper Case, Lower Case, Alphanumeric , Special Characters"

Accordingly i need your help if there is solution can modify password policy on the Active Directory

Thanks a lot in advance

Perhaps you better ask in a

Karsten Iwen — Mon, 11 Jan 2016 09:46:49 GMT

Perhaps you better ask in a Microsoft forum. There you'll probably get more detailed help.

At least your problem should be possible to solve with the help of password-filters.

Thanks Karsten,

Mohamed_Abdelbaky1 — Mon, 11 Jan 2016 09:51:42 GMT

Thanks Karsten,

I think you got my question wrong as i'm asking if there is Cisco AAA Solution (e.g. ISE, ACS) can do these requirements.

Ok, the password policy in

Karsten Iwen — Mon, 11 Jan 2016 10:00:12 GMT

Ok, the password policy in ISE could match your needs, but it's always the policy of the authentication system that enforces the policy. If your users are in AD, then the AD-rules are in place. Only if your users are local to the ISE, these rules are enforced. That's probably not what you want to have.

Unfortunately Yes, Users

Mohamed_Abdelbaky1 — Mon, 11 Jan 2016 10:14:32 GMT

Unfortunately Yes, Users should be kept on AD , i'm wondering if there is Solution can do these requirements while remaining Users Database on AD itself.

nFront has a solution (shows

Karsten Iwen — Mon, 11 Jan 2016 11:55:43 GMT

nFront has a solution (shows up through an easy google-search), there a probably many more.

Thanks again Karsten,

Mohamed_Abdelbaky1 — Mon, 11 Jan 2016 12:50:55 GMT

Thanks again Karsten,

i'm targeting Cisco Solution , not any software

your help is appreciated and i will keep looking for another solution

Hi Mohamed,

Jatin Katyal — Mon, 11 Jan 2016 13:58:42 GMT

Hi Mohamed,

From the discussion, I understood that you want the users to be kept on the AD however the password policy defined on AD has few limitations and you want the authentication server to overwrite the password policy for the authentication query while communicating to the AD. Well that would not be possible. The password policy will be checked for the identity store you have selected on ACS/ISE/ 3rd party AAA server. That means if on ACS server you authentication settings have LOCAL database as an identity store then local database password policy will be applied and if you have AD configured then its own password policy. You need to find out if the above 2 password policy requirements can be modified on the AD itself.

Regards - Jatin