[Professional Engineer]

My last job, the IT guys were so paranoid, that we had to jump thru hoops.

Mandatory password change every 30 days. Minimum of 7 characters. Case sensitive, with a combination of upper and lower case required. One of the characters had to be a numeral. YEESH

[Overtaxed]

Yeah...that's the drill.

[RosieCotton]

Sounds like a fairly standard policy, though 30 days is pretty extreme. We do 90 days, though don't force changes for students...they have such restricted access anyway it isn't as big of a deal.

We encourage the mix of upper and lower and numbers, but don't enforce it for network passwords. It IS enforced for the grade and transcript access system.