Here is the Password Policy guideline for Active Directory.