Windows Password Policy: What exactly do the complexity requirements involve?

Question

I am currently viewing this feature in Windows 7, but I imagine it is very similar if not identical in many of the other Windows OS versions.

I am looking for an explanation of the exact rules for windows password complexity requirements. By this I mean the setting that is available in the following location:

Control Panel > Administrative Tools > Local Security Policy >> Account Policies > Password Policy > "Password must meet complexity requirement"

If you open the properties for this option, and select the "Expain" tab it provides the following list of rules:

Password must meet complexity requirements

This security setting determines whether passwords must meet complexity requirements.

If this policy is enabled, passwords must meet the following minimum requirements:

Not contain the user's account name or parts of the user's full name that exceed two consecutive characters

Be at least six characters in length

Contain characters from three of the following four categories:

English uppercase characters (A through Z)

English lowercase characters (a through z)

Base 10 digits (0 through 9)

Non-alphabetic characters (for example, !, $, #, %)

For the sake of providing a complete answer then feel free to explain each rule in detail, however I am personally only interested in an explanation of the following extract:

Not contain the user's account name or parts of the user's full name that exceed two consecutive characters

What exactly does this mean? It would be very useful to see some examples of passwords that would pass and fail this rule check.

Answer 1

From a TechNet forum post:

If the account name is less than three characters long, this check is not performed because the rate at which passwords would be rejected is too high.

When checking against the user's full name, several characters are treated as delimiters that separate the name into individual tokens: commas, periods, dashes/hyphens, underscores, spaces, pound-signs and tabs.

For each token that is three or more characters long, that token is searched for in the password; if it is present the password change is rejected.

For example, the name "Joey M. Williams" would be split into three tokens:

Joey , M and Williams

Because the second token is only one character long, it would be ignored. Therefore, this user could not have a password that included either "Joey " or "Williams" as a substring anywhere in the password.

All of these checks are case insensitive.

Note: For clarification, the two consecutive characters restriction applies to the splitting of the strings, not the password complexity.

e.g. "Joey M. Williams" could use JoeP@$$w0rd but not JoeyP@$$w0rd