Forum Moderators: open
Periodic password expiration is an ancient and obsolete mitigation of very low value, and we don’t believe it’s worthwhile for our baseline to enforce any specific value. By removing it from our baseline rather than recommending a particular value or no expiration, organizations can choose whatever best suits their perceived needs without contradicting our guidance. At the same time, we must reiterate that we strongly recommend additional protections even though they cannot be expressed in our baselines.
Finally, some password sense
But the most welcome Windows change is likely to be abandoning periodic password resets, a requirement that annoys just about everyone. To explain its shift, Microsoft cites recent research that casts doubt on the efficacy of password expiration policies.
