Max length of passwords

w^rl0rd

Sybex says that passwords can be upto 14 characters,
but the XP Training Kit says 128. Who's right?

Silver Bullet

Well, the Group Policy setting can only be set between 0 and 14 but supports passwords up to 28 characters in length.

Silver Bullet

w^rl0rd wrote:

the XP Training Kit says 128.

Could you imagine if you had to come up with a password that long. Holy COW. I think I would have to find another job.

That has to be a misprint/typo.

w^rl0rd

Well, I tested on my machine and was only able to create one upto 14 characters. Do you think it has something to do with being part of a domain?

Silver Bullet

Yes. Your group policy setting on the domain level will take precedence over the local policy.

That setting is for Minimum Password Length. So if you set the minimum to whatever then you should still be able to make your password up to 28 characters.

woodworm

According to the Sybex 290 book:

If you operate an exclusive Win XP/2000/2003 domain you can have passwords up to 127 characters, if your clients are not exclusively XP/2000/2003 your passwords can be up to 14 characters.

I think if you have 127 character passwords you might spend most of your time unlocking accounts!

Jiggsaww

look @ it dis way.....u will never b outta a job

Silver Bullet

Apparently Microsoft even has conflicting information on this matter

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/strngpw.mspx
Minimum password length determines the minimum number of characters a password can have. Although Windows 2000, Windows XP, and Windows Server 2003 support passwords up to 28 characters in length, the value of this setting can only be between 0 and 14. If it is set to 0, users are allowed to have blank passwords, so you should not use a value of 0. It is recommended that you set this value to 8 characters.

and also:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/d406b824-857c-4c2a-8de2-9b7ecbfa6e51.mspx
Windows passwords can be up to 127 characters long. However, if you are on a network that also has computers running Windows 95 or Windows 98, consider using passwords that are not longer than 14 characters. Windows 95 and Windows 98 support passwords of up to 14 characters. If your password is longer, you might not be able to log on to your network from those computers.

Way to go Microsoft!!!

Webmaster

I always thought it was 127. It seems like those articles indicate that on a standalone Win2003 server it is 127, and when using ADS it is 28. These aren't the things one likely runs into in a real-world setup...

If noone else does, I will start up my lab in a couple of hours to check it.

ebkrantz

Password in windows xp can between 0 and 14 charatcers in length. If xp is joined to a domain i beleive it is still between 0 and 14 characters in length, on the machnies i use it wont go any higher than that. But this is just xp not in 2003 I am talking about. There is alot of conflicting info out there about this.

Webmaster

Password in windows xp can between 0 and 14 charatcers in length.

That's not correct. Those are the min and max for the "Minimum Password Length" setting. If that setting is not configured, and a user changes his password and sets a longer password on Windows XP, it will display a warning that the password won't work for Windows 95 and 98 connection, but it will accept the password. Just try it out.

jescab

I think the max is 127 or 128.

Webmaster

Silver Bullet wrote:

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/strngpw.mspx
Minimum password length determines the minimum number of characters a password can have. Although Windows 2000, Windows XP, and Windows Server 2003 support passwords up to 28 characters in length, the value of this setting can only be between 0 and 14. If it is set to 0, users are allowed to have blank passwords, so you should not use a value of 0. It is recommended that you set this value to 8 characters.

and also:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/d406b824-857c-4c2a-8de2-9b7ecbfa6e51.mspx
Windows passwords can be up to 127 characters long. However, if you are on a network that also has computers running Windows 95 or Windows 98, consider using passwords that are not longer than 14 characters. Windows 95 and Windows 98 support passwords of up to 14 characters. If your password is longer, you might not be able to log on to your network from those computers.

I just did a quick test on a stand-alone Windows XP Pro machine, and it accepts beyond 28 characters, so it looks like the second article is correct.

w^rl0rd wrote:

Sybex says that passwords can be upto 14 characters,
but the XP Training Kit says 128. Who's right?

MS Training Kit is correct. Sybex is outdated or refers to the Minimum Password Length setting.

Silver Bullet

I just tested on AD in Server 2003 and it allowed more than 28 characters as well.

No wonder M$ test are difficult........ maybe we need to proctor these exams to M$ employees or at least to the one that wrote that article.

Webmaster

I think the writer of that article may very well have made a small typo, and that the 28 should be 128. A quick search shows that that article is the only source for '28'.