Microsoft's password guidance paper provides guidance for users as well.

This is the most important restriction when it comes to the creation of passwords as it reduces the impact of brute windows 7 professional attacks.

Microsoft's Account system uses the best practice already. When you try to pick a common buy office 2016 professional plus during account creation, or password reset, you will receive the message "choose a password that's harder for people to guess".

Company employees need to be aware that reusing passwords can have serious implications for security. If an employee uses the same password that he/she uses on company computers elsewhere, attackers may be able to use successful attacks against other accounts of that employee to attack the company network as well.

The last two points go hand in hand. windows 10 enterprise suggests that companies maintain security information such as an alternate email address or phone number. This can be used to inform users about issues but also to authenticate users should the need arise.