End Users Password Requirements

The End-User password for the Exchange or POP/IMAP Mailbox must meet complexity requirements.

Complexity rules:

1. A password must not contain:

   • all or a part of the email address;

   • the entire Display Name.

   • all or a part of SamAccountName;

   Note: The checks are made against the user property called SamAccountName which is visible on a user settings page. SamAccountName is constructed at the time of user creation and consists of the part of their UPN (primary email address) before the @ sign, plus "_" (underscore symbol) + Account name. The maximum size of SamAccountName is 20 characters. Account name may get truncated due to this limitation. You can look up SamAccountName by navigating to Users > click on user's name > click on Display name > See Domain \ User Name. SamAccountName and Full Name are parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the SamAccountName or Full Name is split and each section is verified as not included in the password. There is no check for any individual character or any three characters in succession. 

2. Minimum password length is eight (8) characters.

3. The password must contain characters from three (3) of the following five (5) categories:

   1. English uppercase letters (A-Z) 

   2. English lowercase letters (a-z) 

   3. Numbers (0-9)

   4. Non-alphanumeric characters: ~!@#$%^&*_-+=`|\(){}[]:;"'<>,.?/

   5. Unicode characters that do not fall into one of the above categories (e.g. a Japanese character or non-Latin alphabet letters)
      Note: AVAST has provided a free random password generator here.

4. Users cannot re-use their previous 4 passwords.