I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did some auditing in a friends Company. There they had such a policy. I extracted the password hashes from their Active Directory and let `john` crack the passwords using mangeling rules. 
Many of the passwords were cracked when I choose to use a wordlist that was tailored to the company and its employees. They all used valid passwords according to the policy but using ones firstname, birth year and a random special char in the end isn't that secure.

Now I'm thinking about issueing a random password to every user that he can not change. The password would only be 10 digits long but wouldn't have any relation to the person which I think is much more secure. Do you think this is a good solution or am I missing something?