Enterprise Administration Guide › Implementing Privileged Accounts › Create a Password Policy

Previous Topic: Create a Privileged or Service Account

Next Topic: Password Composition Rules

Create a Password Policy

A password policy for privileged accounts is a set of rules and restrictions that determine permissible privileged account passwords. For example, you can configure the policy to mandate passwords that are at least eight characters long and contain a number and a letter. Password policies also determine an interval at which CA Access Control Enterprise Management automatically creates a new password for the account.

Note: CA Access Control Enterprise Management comes with a predefined password policy that you can use. We recommend that you define password policies that are appropriate for each of your endpoints and adhere to your security requirements.

To create a password policy

  1. In CA Access Control Enterprise Management, click Privileged Accounts, Password Policy, Create Password Policy.

    The Create Password Policy: Configure Standard Search Screen page appears.

  2. (Optional) Select an existing password policy to create the password policy as a copy of it, as follows:
    1. Select Create a copy of an object of type Privileged Account Password Policy, and click Search.

      The list of password policies appears.

    2. Select the object you want to use as a basis for the new password policy.
  3. Click OK.

    The Create Password Policy task page appears. If you created the password policy from an existing object, the dialog fields are pre-populated with the values from the existing object.

  4. Type a name and an optional description for the password policy.
  5. (Optional) Clear Enabled.

    By default, new password policies are enabled. If the policy you are creating is not approved yet, you can choose to clear this checkbox and leave the policy disabled.

  6. Define the password composition rules.
  7. (Optional) Define a password expiration interval.

    This is a regular interval at which CA Access Control Enterprise Management changes passwords automatically. By default, the expiration interval is disabled (set to zero).

  8. (Optional) Define the times, in 24-hour time format, at which CA Access Control Enterprise Management can change the password.

    For example, if you create a password policy for a service account, you can specify that CA Access Control Enterprise Management can change the password of the account only between 10:00 p.m. and 11:59 p.m. (22:00–23:59) on Sundays.

  9. Click Submit.

    CA Access Control Enterprise Management creates the password policy.

More Information:

Password Composition Rules