[RKDinOKC]

Our passwords are linked to our AS400 which is out of date password wise and does not sync well with active directory. Our current passwords are minimum of 8 characters at least one capital letter, one lower case, and one number. It can't contain any special characters and can not start with a number, and no more than 15 characters due to the limitations of our AS400.

On the password change page it tells people to try and use two 3 or 4 letter words with one capitalzied and 2 numbers. Tell them it is secure and easy to remember so they don't have to write it down. But people continue to use spouse or child name and birthday.

They have been talking about upgading the AS400s password and going to single sign on, but it has just been talk for almost 10 years now. And we also have 3 web based systems for HR Training, and project management that will not interface with AD or Azure for single signon.

The new VP of IT first started talking about going to MFA and do the password changing thing. But he has already backed off the change thing and has reduced the MFA to just certain people.