You lose nonrepudiation if more than one person has knowledge of your employee's passwords. Typically, that's how it works though from what I've seen. An organi

You lose nonrepudiation if more than one person has knowledge of your employee's passwords. Typically, that's how it works though from what I've seen. An organization will set a users initial password and the user will have to change it on next login. There are some solutions that will look for known compromised hashes and weak combinations and alert on them or force the user to act, though.