When assigning a password in Vista / Win2k8 it should meet the following requirements:

1. Not contain the user's account name or parts of the user's full name that exceed two consecutive characters
2. Be at least six characters in length
3. Contain characters from three of the following four categories:
    a. English uppercase characters (A through Z)
    b. English lowercase characters (a through z)
    c. Base 10 digits (0 through 9)
4. Non-alphabetic characters (for example, !, $, #, %)

Complexity requirements are enforced when passwords are changed or created.