Passwords are another area to be concerned with. Shoulder surfers can watch employees enter short passwords, and most people, left to their own devices, will assign passwords that can readily be guessed. You can configure password policy in NT 4.0 with the User Manager for Domains tool. To mitigate password-related security problems, expire passwords periodically, so that all users must select new ones. In addition, require a minimum password length of six characters, as longer passwords are harder to guess.
Users typically have a handful of favorite passwords that they assign in rotation.
Hackers know this and will try a user's old password after several days. Enabling password uniqueness prevents this problem. Account lockout is a contentious security feature because it is a popular way for unimaginative troublemakers to deny access to legitimate users. Automatic lockout monitors the number of consecutive login attempts. After a specified number of unsuccessful tries, Windows NT can disable a user's account and prevent further login attempts.