Thread: admin account password expiration

Is it possible to change the period of password expiration for the admin site? Best I can tell the password expires every thirty days, and no password is ever allowed to be reused. For the purposes of my site administrator this is excessive, requiring him to keep the password written down as he's unable to remember which password he used last. The stringent password expiration rules force him into unsafe practices.

The ability to allow the password to remain valid for 90 days would help significantly, as we'd not have to change so frequently, and would be less likely to be confused between the last three passwords.

Thanks -
Brad

You could set the AppConfig: AdminPwdChangeDays to a specific value you intend to lengthen the Expiration.

Right, I don't want to remove the password change requirement, that's excessive. I just want to change the expiration period. That seems like an odd value to have hard-coded.

Is there a minimum requirement for this to remain compliant with PCI or other best security practices?

Well, none from what I heard, but PCI strictly recommends that Administrator should pay considerable attention or consideration on login credentials changing for a tighter security practice...