Password guidelines force users to choose a combination of characters and numbers that make it more difficult for people to guess another user's password.
The Enforce Policy and Restrictions setting in the User Password Management Configuration form determines whether the password guidelines are used for BMC Remedy ITSM Suite. These guidelines can be further customized from the default Health Insurance Portability and Accountability Act (HIPAA) guidelines by the BMC Remedy AR System administrator.
For example, after passwords are reset, users might be forced to change the passwords the next time they log on. Check with your BMC Remedy AR System administrator for information about your site password guidelines. For more information about configuring BMC Remedy AR System password guidelines, see
The default password guidelines, which follow the HIPAA guidelines, are as follows:
- Blank passwords are not allowed
- The password cannot match the login name
- The old password cannot be used when changing the password
- Leading and trailing whitespaces in the password are omitted
- Whitespaces within the password text are retained
- The password cannot be a dictionary word, which is achieved by the following rules:
- Must be a minimum of eight alphanumeric characters
- Must include at least one uppercase alphabetic character
- Must include at least one lowercase alphabetic character
- Must include at least one non-alphanumeric (special) character (for example, #, !, +, %)
Other default restrictions include:
- The administrator or an individual with Security permission must be able to change the password at any time.
- Users (except for the administrator and the individual user) cannot change the password. This is accomplished through the Dynamic Group Access field (ID 60988) on the User form.
- The account is disabled if the user has not changed the password after the number of days specified in the Days after force change until disablement" field in the BMC Remedy AR System User Password Management Configuration form.