A password file is used to connect a user as sysdba to the database using server manager or to connect internal using svrmgrl. It is not used on client side connections only on server side connections.

The exectuable is ORAPWD, if you open a DOS session and type ORAPWD or ORAPWD80, not sure which is for Win NT it will show you the syntax that must be needed to create a password file and what each switch means.

Password files aren't that important unless yuo have users that can access Server Manager that you don't want to have access because all the needs to be done is for them to type connect internal and they are in with rights to shutdown the database or make major changes.

If you are going to set up a password file you must set Remote_password_file=Exclusive in your inti file and shutdown and restart the database for it to take effect. If not set Remote_password_file=none.