A reasonable approach for an AD password policy, this will a be determined by how, & what your ideas are and what your trying to accomplish. I know that you’d mention that a competitor has recently been hack into and security is the number one thing that should be addressed. But putting too many limitations on yourself and your employee might hinder production or have conflicts within the company.
Let’s be honest, passwords are annoying. These days we need a password or PIN’S everywhere for security and protect with a peace of mind. Now days we have so many that we can’t even keep track of them all, I myself have this issue. Here is some issue that might be well in doubt with you and your company. We forget to update them; it’s difficult to come up with effective ones that we can still remember, so we procrastinate changing them for months, even years. We all know that this is bad practice, but the alternative along with the painful, irritating password creation and memorization process, is sometimes more than we can tolerate. Password is simpler and cheaper than others, more secure forms of authentication like special key cards, fingerprint ID machines, and retinal scanners.
While passwords are becoming more and more vital component of system security, and with that they can be cracked or broken relatively easily. Password cracking is the process of figuring out or breaking passwords in order to gain unauthorized entrance to a system or accounts. The difference between cracking and hacking is that codes are cracked, machines are hacked. One simple way of cracking and in a variety of different ways; the most simple is the use of a word list or dictionary program to break the password by brute force. Another easy way for potential intruder to nab passwords is through social engineering: physically nabbing the password off a Post-it from under someone’s keyboard or through imitating an IT engineer and asking over the phone.

I’ve established the importance of password and some of the ways in which they may be vulnerable to cracking; we can discuss ways of creating good strong passwords in creating strong effective passwords it is often helpful to keep in mind some of the approaches by which they may be cracked, so let’s begin with what NOT to do when choosing passwords. As has already been mentioned, password cracking tools are very in effect at processing large quantities of letter and number combinations until a match for the password is found, as such users should avoid using predictable words as passwords. By the same token, they should also avoid regular words with numbers tacked onto the end and conventional words that are simply written backwards, such as ‘nimda’. While these may prove to be difficult for people to figure out, they are no match for the brute force attacks of password cracking tools. One of the frustrating things about passwords is that they need to be easy for users to remember. Naturally, this leads many users to incorporate personal information into their passwords.
A strong, effective password requires a necessary degree of complexity. Three factors can help users to develop this complexity: length, width & depth. Length means that the longer a password, the more difficult it is to crack. Simply put, longer is better. Windows, for example, is not always case sensitive; meaning it doesn’t know the difference between ‘A’ and ‘a’. Some operating systems allow control characters, alt characters, and spaces to be used in passwords. Here are good examples to use for secure practice:

1. uppercase letters such as A, B, C; 2. lowercase letters such as a, b, c; 3. numerals such as 1, 2, 3; 4. special characters such as $, ?, &; and 5. alt characters such as µ, £, Æ
When planning password policy’s stress extra protection, in some cases, a good password is enough protection to keep out intruders. In others, it’s just a start. Encryption and one-time passwords add extra protection to systems. Encryption means garbling the password to protect from sniffers or other onlookers, through a particular scheme that can be deciphered from the other end of the connection. Users should exercise extreme caution when writing down or storing passwords. Stories of hackers obtaining passwords through shoulder-surfing and dumpster diving are not urban myths, they are real. Here a good practice for a company to use, In order to ensure their ongoing effectiveness, passwords should be changed on a regular basis. Changing passwords securely is fairly simple. Windows passwords are changed through the Control Panel and in UNIX, the ‘passwd’ command generally does the trick.
Managers and administrators can enhance the security of their networks by setting strong password policies. Password requirements should be built into organizational security policies. Network administrators should institute by regular changes/updates of passwords. New users should be taught about good password practices. Providing intranet resources on network security and password security can also be helpful. Finally, the organization’s password policy should be integrated into the security policy, and all readers should be made to read the policy and sign-off on it. Systems administrators should implement safeguards to ensure that people on their systems are using adequately strong passwords. They should set password expiration dates on all programs being run on the organization’s systems. Keep a password history to prevent reuse, and lock of accounts after 3-5 password attempts.

Citations

1) Cliff, A.: “Password Crackers - Ensuring the Security of Your Password”, Security Focus, Feb. 19, 2001. http://online.securityfocus.com/infocus/1192 2) Armstrong, Del and Simonson, John: “Password Guessing” and “Password Sniffing,” An Intro to Computer Security, School of Engineering & Applied Sciences, University of Rochester, Oct. 25, 1996.
http://www.seas.rochester.edu:8080/CNG/docs/Security/security.html