0

SQL and Windows version: Microsoft SQL Server 2017 (RTM-CU19) (KB4535007) - 14.0.3281.6 (X64) Jan 23 2020 21:00:04 Copyright (C) 2017 Microsoft Corporation Developer Edition (64-bit) on Windows Server 2016 Standard 10.0 (Build 14393: ) (Hypervisor)

Servers are in Workgroup.

Our Password Complexity Parameters for SQL login:

  1. has at least one digit
  2. has at least one uppercase character
  3. has at least one special character
  4. has at least one lowercase character

We are able set initial password for new SQL login as a TestingDB@001 and testingdb@001. But new initial password should be TestingDB@001 NOT testingdb@001 as per above Complexity Parameters. Is this expected behaviour of SQL 2017 for SQL login password?

We have tried to create OS user (non admin windows account), OS level also its taking both passwords (TestingDB@001 and testingdb@001). As per above Complexity Parameters, it should accept only TestingDB@001 password. Is the above SQL login password issue is due to OS?

Please suggest how to achieve above Complexity Parameters in password creation.

We have set below policy in local computer policy on DB server. enter image description here

Improve this question
3
  • Have you read through the documentation to confirm you have everything setup properly? – LowlyDBA - John M Apr 9 '20 at 15:01
  • HI , Yes, I have already read doc. My requirement is password should be TestingDB@001. But It's accepting both passwords - TestingDB@001 and testingdb@001. – Sridhar G Apr 10 '20 at 3:58
  • Hello, @SridharG. Were you able to fix this problem? – Ronaldo May 20 '20 at 13:12
2

Is this expected behaviour of SQL 2017 for SQL login password?

Yes, it is expected. You might have overlooked the three of the following four categories part of the Password Complexity doc:

  • The password contains characters from three of the following four categories:
    • Latin uppercase letters (A through Z)
    • Latin lowercase letters (a through z)
    • Base 10 digits (0 through 9)
    • Non-alphanumeric characters such as: exclamation point (!), dollar sign ($), number sign (#), or percent (%).

Therefore the password TestingDB@001 has characters from the four categories while testingdb@001 has characters from three (which is the minimum acceptable to pass), so both passwords are in accordance with the policy.

As for the Windows login it has a policy Reference that is quite like the one from SQL Server and also says The password contains characters from three of the following categories.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.