Although as part of security measures, in the past, Microsoft would advise to configure password-expiration policies, a new security baseline draft for Windows Server and Windows 10 version 1903, the company reveals that forcing users to change their passwords is an “ancient and obsolete mitigation of very low value.”
This is not to say that Microsoft is dropping its password-expiration policies on all its software and services, but the new security baseline makes it clear that security has changed throughout the years, and expiring passwords is no longer a top priority.
In a new article at the Microsoft Security Guidance blog, the company explains, if a password never gets compromised, then it’s no need to expire it to force the user to change it. On the other hand, if a password gets compromised, there’s no point to wait until it expires, because you want to change that password immediately.
Furthermore, periodically expiring a password has its caveats. For instance, it makes easier for users to forget their password, and pushes users to write down the password in the back of the keyboard or on a sticky note.
Microsoft also says: “if your users are the kind who are willing to answer surveys in the parking lot that exchange a candy bar for their passwords, no password expiration policy will help you.”
Also, in the new security baseline draft, the company acknowledges that password security is an ongoing problem, but banning certain passwords, using multi-factor authentication, efficiently detecting password-guessing attacks and anomalous login attempts are more effective measure to keep the network and data secure.
Starting with the May 2019 Update for Windows 10 and Windows Server, Microsoft is planning to stop using password-expiration policies from its baseline, but the policies for complexity, history, length and other requirements for setting up a password will remain.
Mauro Huculak is a Windows How-To Expert who started Pureinfotech in 2010 as an independent online publication. He has also been a Windows Central contributor for nearly a decade. Mauro has over 15 years of experience writing comprehensive guides and creating professional videos about Windows and software, including Android and Linux. Before becoming a technology writer, he was an IT administrator for seven years. In total, Mauro has over 21 years of combined experience in technology. Throughout his career, he achieved different professional certifications from Microsoft (MSCA), Cisco (CCNP), VMware (VCP), and CompTIA (A+ and Network+), and he has been recognized as a Microsoft MVP for many years. You can follow him on X (Twitter), YouTube, LinkedIn and About.me. Email him at [email protected].