Came in to a small company
Had new password policy in place within a week - however removed the silly mandatory symbols etc and just put longer passwords however informed everyone of the horse.battery.staple paradigm and not to mess with cryptic hard to remember 8-10 characters but to have longer plain text easy to remember words .. it was welcomed - I also removed the auto expiry - passwords would only change if there was a suspected leak or other reason there might be an issue. Also made sure to have proper group policies so that passwords remained strictly personal and no sharing of passwords ever.. that with some SSO implementations seemed to get everyone on side.- some confided to me previously they'd just upnumber one password all the time - to which I told them - I know that's what everyone does which is why that doesn't work.