“7-8 letter passwords are dead. Any pentester or hacker can crack them in under three minutes” pass phrases please. Length beats complexity. Have different password policies for service accounts and privileged users.