I think a lot of that is what companies want to do with AD. I doubt MSFT is in the business of deciding what people's password policies should be (apart from pi

I think a lot of that is what companies want to do with AD. I doubt MSFT is in the business of deciding what people's password policies should be (apart from picking a sane default). I do think passwords today fail basic usability tests. Having people remember random long, frequently changing strings of letters and numbers is a recipe for disaster. Its sad that we as an industry haven't thought of something better.