Is it still a good idea to require users to change their passwords?
May 10, 2021
For as long as corporate IT has been in existence, users have been required to change their passwords periodically. In fact, the need for scheduled password changes may be one of the most long-standing of all IT best practices. Recently, however, things have started to change. Microsoft has reversed course on the best practices that it has had in place for decades and no longer recommends that organizations require users to change passwords periodically . Organizations are being forced to consider, perhaps for the first time, whether or not requiring periodic password changes is a good idea. Microsoft password reset recommendations According to Microsoft, requiring users to change their passwords frequently does more harm than good. Humans are notoriously resistant to change. When a user is forced to change their password, they will often come up with a new password that is based on their previous password. A user might, for example, append a number to the end of their password