Your ASP.NET application should use windows authentication when your users have windows accounts that can be authenticated by a server. The accounts can be local windows accounts or domain accounts.
You can enforce strong passwords using membership by configuring the attributes minRequiredPasswordLength, minRequiredNonAlphanumericCharacters, and passwordStrengthRegularExpression on your membership provider configuration.