Re: Are forbidden passwords taken into account when password is generated?

Not by the FM itself. The policy is always checked in the kernel.

Since the FM itself is a kernel-call, all the usual security checks done by the kernel apply. Hence the rules defined in USR40 are definitely taken into account.