Topic starter
24/06/2026 7:15 pm
TL;DR: Most organisations already have password policies, but policy alone does not stop weak, reused, or compromised credentials from being used at endpoints, according to Netwrix. The real control gap is enforcement at the point of creation and throughout the credential lifecycle, not the existence of a written rule.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “You still have passwords. Now enforce them.”.
Key questions
Q: Why do password policies fail if they are not enforced at creation time?
A: Because policy describes acceptable behaviour, but enforcement determines whether bad credentials are actually rejected.
A: Security teams should start by mapping where weak, reused, or unsecured passwords still exist across apps, browsers, shadow IT tools, and unmanaged AI platforms.
Q: What signals show that password enforcement is actually working?
A: Working enforcement shows up as high rejection rates for weak or reused passwords, fewer user workarounds, and fewer accepted passwords that later match exposed patterns.
Practitioner guidance
- Enforce password checks at creation time Block weak, common, and compromised passwords before they are accepted, rather than relying on users to self-correct after a policy warning.
- Prevent password reuse and near-reuse Reject slight variations of old passwords so users cannot bypass complexity rules with predictable substitutions like appended numbers or symbols.
- Use breach and dictionary screening Compare candidate passwords against breach databases and local dictionaries to stop known weak patterns from entering the environment.
Bottom line: Password policy alone does not prevent weak credentials from entering or surviving in Active Directory environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:27 am
Password policy without enforcement is a governance artefact, not a control. Organisations often confuse the existence of complexity rules with actual credential protection. In practice, weak and compromised passwords continue to exist because the policy does not govern what gets accepted at creation time or how reuse is handled later. The practitioner conclusion is simple: if the control does not block bad credentials, it is only documentation.
A few things that frame the scale:
- According to Forrester Research, a single password reset can cost around $70.
A question worth separating out:
Q: What is the difference between password policy and password enforcement?
A: Password policy defines the rule set, such as length, complexity, and rotation. Password enforcement applies those rules at the point of creation and reuse so that weak or compromised passwords cannot be accepted. One states the standard, the other makes the standard operational.
👉 Read our full editorial: Password policy enforcement is the real control gap in AD