you should consider using a microsoft windows server 2008 multi password policy