nFront Password Filter provides password creation policy enforcement specifically for Active Directory; allowing the creation of policies that govern how many of certain types of characters must be present in passwords, their length, and other security-related characteristics of the passwords before allowing them to be set in A/D.

The product is installed on each Domain Controller in the organization. Once installed, configuration is via the GPO mechanism--the administrator creates a single GPO on one of the Domain Controllers, and imports into it a provided template from the vendor. From there, the password policy(ies) (via Active Directory Users and Computers or the Group Policy Management Console) can be configured on any Domain Controller, with automatic replication to all other Domain Controllers.

In the MPE version of the product (see below) password policies are then applied (linked) to groups of users, with the vendor noting that the password enforcement calls themselves are processed entirely within the Domain Controller (i.e., no external policy server is required). Any local DC can filter password change requests.

Multiple rules can be enabled for password policies; including min/max length of passwords; min/max numbers of alpha, non-alpha, numeric, upper case, or lower case characters; automatic rejection of passwords containing vowels; automatic rejection of passwords containing the user's username or full name; limitations regarding special characters (must be included or must be excluded); dictionary word checks (automatic rejection of words that appear in a dictionary), and more. For the dictionary checks in particular, the vendor provides a 27,000 word dictionary file that can be amended or customized by the customer using any plain text file editor. The vendor further states that the dictionary check rule is capable of scanning over 2 million words per second; and both full and partial (where a portion of the dictionary word contains the proposed password) dictionary matches are supported, per the desired settings of the password policy.

Other features of the product include a password change client that can run on local workstations and provides for the user the exact rules required for their passwords, the reasons why their proposed password was rejected, and a password strength meter; reporting features for expired passwords; the ability to upgrade the software without rebooting the Domain Controller (but note that the initial installation of the filter on the DC requires a reboot); and support for Microsoft Services for UNIX.

Multiple flavors of the product are available. The Multi-Policy Edition (MPE) supports up to 6 different password policies, each of which can be applied to or excluded from global groups. The Single Policy Edition supports a single policy that applies to all domain users. Both the Multi-Policy Edition and the Single-Policy Edition are run from the Domain Controllers.

The Single Policy Edition for Member Servers supports a single password policy that applies to all local policies on a member server; and the Desktop Edition supports a single password policy that applies to local accounts on a desktop. Both the Member Server and Desktop Editions can be controlled by Group Policy.

The nFront Password Filter is available now. Contact nFront Security for further information.