nFront Password Filter FAQ

Yes. nFront Password Filter has been tested with Windows 2003 and Windows 2000 in all 3 modes: Windows 2000 mixed, Windows 2000 native and Windows Server 2003 mode. In each case all settings were thoroughly tested and subjected to over 10,000 password changes.

Yes, Yes and Yes. We have many worldwide deployments using BMC Control SA or Passport. We also have many healthcare providers running PSynch and Courion. In all cases, the BMC, PSynch and Courion do not provide native password filtering (only filtering if you change passwords via their web page). Thus, their password filtering rules can be bypassed.

nFront Password Filter SPE and MPE are licensed per Windows NT 4 or Windows 2000 / 2003 domain controller. The Desktop Edition and Member Server Edition are licensed per workstation or server.

The SPE and MPE versions must be licensed for the number of domain controllers in the domain where the product is deployed. However, the Desktop and Member Server editions can be deployed to specific servers or workstations (like key SQL servers for example).

The Windows NT 4 version uses an initialization file because it is easy to maintain and secure. Windows NT 4 includes no Registry replication mechanism like the Group Policies in Windows 2000. While a front-end program could be used for Registry manipulation, it would require a substantial amount of error-checking to avoid Registry contention and to properly handle simultaneous access to multiple remote Registries. Considering Windows 2000 went to press with 30 million lines of code and 63,000 known bugs, Altus has decided to keep it simple and provide an initialization file instead of Registry manipulation tools for Windows NT 4.

The default dictionary (27,000 words) takes about 20 milliseconds to process. Most servers will process around 2.5 million words per second. So in less than one second nFront Password Filter can check a user's proposed new password against over 2 million common passwords.

Yes. All group policies will appear in English. If you are using dictionary checking you must save the dictionary file in an ANSI format. The optional client currently provides messages in English, German and Italian. It will soon be translated into other langauges as well.

Of course! The trick here is your SAMBA configuration file of course. You need to configure SAMBA to authenticate against your Windows domain. You can join your SAMBA machine to the Windows domain just as you would any Microsoft machine. From there you must edit the smb.conf file to indicate you wish to authenticate against one or more domain controllers and provide a mapping file to map Windows users to UNIX users.

You cannot apply different password policies to different OUs. However, you can use the MPE version to apply different password policies to different global or universal security groups. It is very likely you already have such groups defined for purposes of administering file system security.

YES. nFront Password Filter has been tested with Microsoft Services for UNIX 2.0 on a Windows 2000 domain and works very well. Filtered passwords are rejected and not committed to any system. Passwords that pass the nFront Password Filter policy are accepted and committed to both the Microsoft domain and the specified UNIX servers.