If I am reading the documentation right, the effect of having the "8-bit" character class (decimal 128 or less - though this seems more like 7 bit plus decimal 128) is that if you change the password policy character classes from 0 (no checking) to 1, almost anything will match, but unicode characters wouldn't match (so you'd require at least 1 non-unicode non-high ASCII character, excepting of course the oddball decimal 128). Thus, ignoring unicode, if you want to match at least 3 of the other normal classes (upper/lower/digits/special) you'd actually need to set this value to 4?