Configuring the user security policy

To configure the user security policy, do as follows:

1. Go to Settings → Options (1) → Security policy (2).
   
2. Set the minimum password length (3).
3. Set the number of the most recent passwords for each user to be stored in history (4). 0—do not store password history. If this value is different from 0, the passwords that are stored in history cannot be used when setting a new password.
4. Set the password validity period in days (5). After the validity period expires, the user will be prompted to set a new password. 0—the password validity period never expires.
5. Select the positions to meet complexity requirements: nothing, password only, username and password (6).
   The requirements:
   1. Username:
      1. should contain at least six characters and at least two digits;
      2. should not include common role names, such as: user, admin, administrator, administrator1, root, super, superuser, supervisor.
   2. The password must contain at least eight characters that must meet at least three requirements for passwords containing less than 10 characters and at least two requirements for passwords containing 10 or more characters:
      1. At least one uppercase letter;
      2. at least two lowercase letters;
      3. at least three digits;
      4. at least four special characters: . , : ; ! ? \ | / ( ) [ ] { } + − = < >" @ ' # * $ ` % ^ & _ ~.
6. If you need to limit the number of sessions per user to one, set the corresponding checkbox (7). This requirement also applies to Web-Clients and mobile Clients.

7. Set the number of failed logon attempts to lock a user's account (8). 0—no account locking on incorrect passwords. If this value is different from 0, when a new user is created, they will be given the name User with a random number from 10000 to 99999. The name can be changed in the user settings.

   Attention!

   When unblocked, the user is offered only one authentication attempt. A successful authentication will reset the failed attempts counter to zero, otherwise the user account will be blocked again.

8. Set the duration of user account lockout on failed login attempts in minutes (9). 0—the account can be unlocked by the administrator only (see Locking a user account).
9. Click the Apply button.

Configuring the user security policy is complete.