Read through the following recommendations:
Generate an AES 256-bit tree key and re-encrypt passwords with it.
Disable Universal Password and enable Password Based Key Derivation Function 2 (PBKDF2) hashes of passwords in the following conditions:
If you are using eDirectory without Identity Manager.
If you do not require user password retrieval.
If Universal Password is required, it should be enabled only for the users who need it, not forthe whole tree.
Configure password policies to enforce:
Strong passwords
Changing passwords periodically and frequently
Password history