nFront Password Filter FAQ

Yes. nFront Password Filter has been tested with Windows 2008 R2, Windows 2008, Windows 2003 R2, Windows 2003 and Windows 2000 in all modes: Windows 2008 native, Windows 2000 mixed, Windows 2000 native and Windows Server 2003 mode. In each case all settings were thoroughly tested and subjected to over 10,000 password changes.

Yes, Yes and Yes. We have many worldwide deployments using BMC Control SA or Passport. We also have many healthcare providers running PSynch and Courion. In all cases, the BMC, PSynch and Courion do not provide native password filtering (only filtering if you change passwords via their web page). Thus, their password filtering rules can be bypassed.

The Windows NT 4 version uses an initialization file because it is easy to maintain and secure. Windows NT 4 includes no Registry replication mechanism like the Group Policies in Windows 2000. While a front-end program could be used for Registry manipulation, it would require a substantial amount of error-checking to avoid Registry contention and to properly handle simultaneous access to multiple remote Registries. Considering Windows 2000 went to press with 30 million lines of code and 63,000 known bugs, Altus has decided to keep it simple and provide an initialization file instead of Registry manipulation tools for Windows NT 4.

The default dictionary (27,000 words) takes about 10 milliseconds to process. Most servers will process around 3 million words per second. So in less than one second nFront Password Filter can check a user's proposed new password against over 3 million common passwords.

Yes. All group policies will appear in English. If you are using dictionary checking you must save the dictionary file in an ANSI format. The optional client currently provides messages in English, German, French, Italian and Spanish.

Of course! The trick here is your SAMBA configuration file of course. You need to configure SAMBA to authenticate against your Windows domain. You can join your SAMBA machine to the Windows domain just as you would any Microsoft machine. From there you must edit the smb.conf file to indicate you wish to authenticate against one or more domain controllers and provide a mapping file to map Windows users to UNIX users.

Yes.  You still configure a single GPO to control nFront Password Filter.  However, within each policy you can specify multiple OU paths to include or exclude.  You can also include and exclude groups.

YES. nFront Password Filter has been tested with Microsoft Services for UNIX 2.0 on a Windows 2000 domain and works very well. Filtered passwords are rejected and not committed to any system. Passwords that pass the nFront Password Filter policy are accepted and committed to both the Microsoft domain and the specified UNIX servers.