Password Filter Programming Considerations

When implementing password filter export functions, keep the following considerations in mind:

• Take great care when working with plaintext passwords. Sending plaintext passwords over networks could compromise security. Network "sniffers" can easily watch for plaintext password traffic.

• Erase all memory used to store passwords by calling the SecureZeroMemory function before freeing memory.

• All buffers passed into password notification and filter routines should be treated as read-only. Writing data to these buffers may cause unstable behavior.

• All password notification and filter routines should be thread-safe. Use critical sections or other synchronous programming techniques to protect data where appropriate.

• Password notification and filtering take place only on the computer that houses the account.

• All domain controllers are writeable, therefore password filter packages must be present on all domain controllers.

  Windows NT 4.0 domains: Notification on domain accounts takes place only on the primary domain controller. In addition to the primary domain controller, the password filter packages should be installed on all backup domain controllers to allow notifications to continue in the event of server role changes.

• All password filter DLLs run in the security context of the local system account.

For information about	See
How to install and register your own password filter DLL.	Installing and Registering a Password Filter DLL
The password filter DLL provided by Microsoft.	Strong Password Enforcement and Passfilt.dll
Export functions implemented by a password filter DLL.	Password Filter Functions