agreed. If one has such common policy, one reduces the efforts that a brute force attack has to take since it can skip the passwords that do not follow the policy.