Prohibit certain characters in passwords

[Jay Simmons]

Thank you @JasonLoosus - I agree this is a good idea and I have gotten the feedback from multiple customers. I have captured the feedback as a backlog item.

[stromnessian]

I don't mind characters like 0, 1, o, O, etc. where you can distinguish between them, but lower case L and capital i are indistinguishable (because of the font dictated by the page body CSS).

[Ali11CH]

This is a great suggestion that would help avoid much frustration, makes a lot of sense.

[Mustermann1981]

Agreed, the LAPS options should be more userfriendly. Also the use of special characters should be limited (e.g. ignore ` ´ ' ").

[Sebastian Pasch]

I have just come across this issue... - take a look at my LAPS password....

you would never guess the difference between lower case L and capital i

[5K7NzlxZI7[E]

[5K7NzlxZI7[E]

please fix this - simple as changing the font, like the code  option in this post :)

[Jay Simmons]

@Sebastian Pasch - yep I got it.    

There are two improvements in the pipeline:  a new password complexity setting that uses a slightly smaller dictionary which excludes the commonly confused characters (like L and I in your example).  

In addition, the LAPS tab in ADUC has been tweaked to use a simpler font:

It looks from your screen snippet that you are retrieving a password from the Entra management portal. So the ADUC fix probably won't help you, but the simpler character dictionary should.  The Entra team has also received similar feedback about the fonts used to display passwords in their portal.

Thanks for the feedback!

Jay

[Sebastian Pasch]

Thanks @Jay Simmons !

indeed we are using EntraID/intune for LAPS - we are just rolling out LAPS across our environment and fully adopting the modern management approach.

If there is any way to push for the portal update, I'd be more than happy to demonstrate the business impact.

Thanks

Sebastian Pasch

[Jay Simmons]

@Sebastian Pasch  - I just now passed on your latest feedback to the Entra team.  Otherwise the next best thing I can suggest is posting a request to fix the problem on the following Entra forum:

Microsoft Entra (Azure Active Directory) · Community

Hopefully the issue will get more visibility there.  And please copy your post link back in this topic - maybe we can get a vigorous feedback loop going between the two forums :-).

thanks,

Jay

[Sebastian Pasch]

thanks so much Jay,

I found one existing post there as well and replied to it - also linking back here:

Windows LAP for Azure AD · Community

[Jay Simmons]

Hi @JasonLoosus (and others in this thread):

Please check out the new Windows LAPS "improved readability" password complexity feature (and other new features!) that dropped in today's 26040 Canary build:

Announcing Windows 11 Insider Preview Build 26040 (Canary Channel)

I am actively seeking feedback on all of these features - just let me know.

I realize that the new "improved readability" password complexity feature does not exactly match the requested feature (configurable ability to exclude certain characters).  To keep things as simple as possible, I chose instead to implement an alternate "dictionary" setting which has all of the confusing characters removed.   (Plus improving the password font as used in ADUC.)

Of course, you could also just switch to using passphrases which are even better IMO. :)

Jay

[Sebastian Pasch]

Thanks so much @Jay Simmons  - looks like changing complexity value from 4 to 5 is going to fix that for us in omitting the problematic carachters to be used! That's great news!