>>Bruce here is some info on the side of your network guys.. I don't completely agree with it all.
>>
>>http://www.ntsecurity.net/scripts/loader.asp?iD=/security/tips.htm
>
>Thanks, Evan (I think :) That's likely the exactly the sort of doc the security guy got his info from, most of it looks familiar. It doesn't give any reason why not to display last user name, though. We already have permanent lockout after 3 bad logon attempts, you have to go in person to central security and show your ID badge to get back in. So I think probably the security guy is just kind of mindlessly following the recommendations, is my guess - he can't seem to justify his position, as I say...

We now have a computer security office at the hospital. The guys have went security nuts, overboard, overkill... They wouldn't even allow me to run any apps from certain computers, thankfully I have worn them down a bit.

They have enforced one application to require password changes every six weeks. The result has been staff forget their passwords often and end up sharing passwords. The result has been weakened security.

You have my sympathy. :-)