Yes. It has been tested and works fine wiht Windows Server 2016.

Version 6.0.0 or later is needed to support Windows Server 2012 R2.

Yes, Yes and Yes. We have many worldwide deployments using BMC Control SA or Passport. We also have many healthcare providers running PSynch and Courion. In all cases, the BMC, PSynch and Courion do not provide native password filtering (only filtering if you change passwords via their web page). Thus, their password filtering rules can be bypassed.

The default dictionary (27,000 words) takes about 10 milliseconds to process. Most servers will process around 3 million words per second. So in less than one second nFront Password Filter can check a user's proposed new password against over 3 million common passwords.

Yes. All group policies will appear in English. If you are using dictionary checking the dictionary file may be saved in an ANSI, Unicode or UTF-8 formats. The later formats supports characters from all languages. The optional client currently provides messages in English, German, French, Italian and Spanish.

Of course! The trick here is your SAMBA configuration file of course. You need to configure SAMBA to authenticate against your Windows domain. You can join your SAMBA machine to the Windows domain just as you would any Microsoft machine. From there you must edit the smb.conf file to indicate you wish to authenticate against one or more domain controllers and provide a mapping file to map Windows users to UNIX users.

Yes.  You still configure a single GPO to control nFront Password Filter.  However, within each policy you can specify multiple OU paths to include or exclude.  You can also include and exclude groups.

Yes. You can apply a policy to one security group and the policy will apply to users who are members of that group and any groups nested inside of that group.

Yes. When upgrading you do not have to upgrade all domain controllers at once. Each DC has the configuration data needed to make its own independent decision. No API calls leave the DC so each DC operates independently. When running mixed versions you should be sure to only use features and rules supported by the earliest version.