Passwords and Expiry¶
Two per-account problems that policy doesn't fix on its own: accounts with weak or missing passwords, and accounts whose passwords never expire.
Find accounts with no password¶
Get-LocalUser | Where Enabled | Select Name, PasswordRequired, PasswordLastSet
PasswordRequired: False means the account can log in with a blank password.
Set a password¶
If the README tells you a user's password, an attacker who reads the README knows it too. Change every password you know, and every one that's blank.
net user bob N3wStr0ngPassw0rd!
Or prompt for it so it doesn't sit in the command history:
net user bob *
lusrmgr.msc → Users → right-click → Set Password → Proceed. Read the warning; it's about encrypted files, which don't matter on a competition image.
Settings can only change your own password. For other users, use lusrmgr.msc or Control Panel → User Accounts → Manage another account.
Passwords have to meet the password policy. Set the policy first, then set passwords, so you don't have to do it twice.
Make passwords expire¶
"Password never expires" is a per-account flag. The policy's maximum age doesn't apply to an account with the flag set.
Get-LocalUser | Where Enabled | Select Name, PasswordExpires
A blank PasswordExpires means never. Fix:
Set-LocalUser -Name bob -PasswordNeverExpires $false
Or all at once:
Get-LocalUser | Where Enabled | Set-LocalUser -PasswordNeverExpires $false
GUI: lusrmgr.msc → user → Properties → untick Password never expires.
Force a change at next logon¶
For accounts whose password you just reset, tick User must change password at next logon so the real user picks their own. Command line:
net user bob /logonpasswordchg:yes
The local Administrator password¶
The STIG requires the built-in Administrator's password to change at least every 60 days, and in a domain the tool for that is Windows LAPS, which rotates each machine's local admin password automatically and stores it in Active Directory. On a standalone image, set a strong password and make sure the account is disabled (Built-in Accounts).
Two flags that block the above¶
In the same Properties dialog, User cannot change password should be unticked for human users, or they can't comply with expiry. And Password never expires and User must change password at next logon can't both be ticked.
Example¶
Name Enabled PasswordRequired PasswordExpires
alice True True 12/1/2026
bob True False
carol True True
bob: no password required. Set one, force change at next logon.carol: password never expires. Clear the flag.alice: fine.
Verify¶
Get-LocalUser | Where Enabled | Select Name, PasswordRequired, PasswordExpires
Every row: PasswordRequired True, PasswordExpires with a date.