Password and Lockout Policy

A company's sign-in policy has been set with old habits: short passwords with rigid character rules, forced changes every month and no protection against repeated guessing. Current public guidance favours longer passwords, screening against known-bad passwords, a second factor and sensible lockouts, and warns against rules that push people into predictable patterns.

Use the settings form to change the policy. Set a minimum length that fits current advice, limit repeated failed sign-ins with a lockout that ends by itself after a while, require a second factor, screen against breached passwords and let people use password managers. Replace rules that create bad behaviour with rules that help. Each failed check explains the thinking behind it.

A policy that locks people out permanently is not secure: it is a way to stop staff working, so the lockout must recover. All required checks must pass to release the flag. The lab only reads the text you submit; nothing is applied to a real system, and the check tells you what is still weak and why, never the exact line to type.