Home Forums SQL Server 2008 Security (SS2K8) Enabling "Enforce password expiration" on an account with an old password RE: Enabling "Enforce password expiration" on an account with an old password

  • Jason,

    I am not sure if you got a complete answer yet, but I had the same issue last year. The auditors required that the SQL logins have an expiration for a custom application. The application was using SQL logins. I went into Test and checked Enforce Password Policy and Enforce Password Expiration. This caused the SQL logins to adhere the the domain password policies, including expiration and complexity. If you want to check what your policy is, just hit Start and type secpol.msc and check the local policies.

    Long story short, SQL did throw an error for those users' passwords that were beyond the expiration date. We were able to capture that error in the application and force a password change when they logged in the first time.

    The best thing is probably single sign on, but that was not an option for us and it sounds like it may not be an option for you. Either way you should be aware that turning that on will give you problems.

    CHECK_POLICY = { ON | OFF }

    Applies only to SQL Server logins. Specifies that the Windows password policies of the computer on which SQL Server is running should be enforced on this login. The default value is ON.

    http://msdn.microsoft.com/en-us/library/ms189828.aspx