I have read Sequential password updates and I am aware of a number of techniques to prevent users from using password variants. My question is, which of these techniques are actually used in user authentication in a Microsoft domain server? I am no expert in server software - what I mean is the (supposedly) common backend to user administration and authentication of login attempts to domain user accounts with Windows, Outlook, Outlook Web Access, which all seem (be able to) use the same data and enforce the same password rules, including prevention of re-use of substrings of historic passwords.
Is any hard information available from systematic tests? Has source code been leaked that drives this prevention of variations? Or what else is known? E.g., how many, or for how long back, are old password hashes stored? Which variants are pre-hashed and stored along a new password? What of that is fixed, and what is configurable by the administrators?
Background: I am an interested user fed up by having to change my password every 90 days without any reason. IT admins won't admit that's a nonsensical idea, despite recent NIST recommendations. It's not a terribly important account, so of course I resort to using password variants. I simply want to make my life easier by being able to predict which password variants are allowed - I typically spend 10-20 minutes in a quarter coming up with a new variant that's allowed.