Re:49% of workers, forced to change passwords, reuse same on...
by tialaramex on Saturday December 14, 2019 @06:08AM
(#21788894)
Try to get the AD policy revised. Because there is (since 2017) clear NIST guidance saying not to do this, chances are that somewhere in your organisation a document can be updated to cite that NIST guidance and then the AD controls can be relaxed to let passwords have the same lifetime as the account they're for. Finding who owns this policy and getting them to fix it may take a bit longer than one of those 90 day password changes, but it'll feel like you made the world better and it may only take a phone call or an email to the right person.
Newer Windows AD builds have FIDO2 support, so on shiny new computers you _could_ unlock "your" computer (one you've logged into recently) with a FIDO2 USB key, or a fingerprint reader. That's a much nicer way to unlock a computer you use all the time, while not discouraging you from using a nice long password that bad guys would need to guess or steal to get in from a different machine.
Newer Windows AD builds have FIDO2 support, so on shiny new computers you _could_ unlock "your" computer (one you've logged into recently) with a FIDO2 USB key, or a fingerprint reader. That's a much nicer way to unlock a computer you use all the time, while not discouraging you from using a nice long password that bad guys would need to guess or steal to get in from a different machine.