Skip to content

Password Policy

Password policy forces every account on the machine to meet a minimum. Without it, a user can set their password to a.

Where it is

secpol.msc → Account Policies → Password Policy. Double-click a setting to change it.

On a Server 2022 domain controller, the policy that applies to domain accounts is in gpmc.msc → Default Domain Policy → Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies. Same settings, different tool.

The settings

Each has a floor and a ceiling. Too low is useless; too high pushes people to write passwords down. The "Use" column is the middle of what security baselines (Microsoft, CIS, DISA STIG) call reasonable.

Setting What it does Reasonable range Use
Enforce password history (1.1.2) How many old passwords are remembered and can't be reused 10 to 24 (STIG: 24) 12
Maximum password age (1.1.1) Days before a password must be changed 30 to 90 (STIG: 60 or less) 60
Minimum password age (1.1.3) Days a user must keep a new password before changing again. Without it, a user changes their password 12 times in a row to get back to the old one. 10 to 30 10
Minimum password length (1.1.4) Fewest characters allowed 10 to 20 (STIG: 14) 12, or 14 for a STIG baseline
Password must meet complexity requirements (1.1.5) Three of: uppercase, lowercase, digits, symbols. Also blocks passwords containing the username. Enabled Enabled
Store passwords using reversible encryption (1.1.7) Stores passwords so they can be decrypted, which defeats hashing Disabled Disabled

Minimum age must be less than maximum age or Windows refuses the change. Windows caps history at 24.

One more setting in the same folder: Relax minimum password length limits (CIS 1.1.6) should be Enabled. Without it, Windows caps the minimum length policy at 14 characters; with it, you can require longer passwords if the organization's policy calls for them.

Warning

Reversible encryption is the one people miss. It defaults to Disabled, so nobody thinks to look. An image may have turned it on.

Step by step

  1. Open secpol.msc.
  2. Expand Account Policies, click Password Policy.
  3. Double-click Enforce password history, type 12, OK.
  4. Maximum password age: 60.
  5. Minimum password age: 10.
  6. Minimum password length: 12.
  7. Password must meet complexity requirements: Enabled.
  8. Store passwords using reversible encryption: Disabled.

Verify

net accounts

Minimum password age (days):                          10
Maximum password age (days):                          60
Minimum password length:                              12
Length of password history maintained:                12

Complexity and reversible encryption don't show here. For those:

secedit /export /cfg C:\secpol.txt
findstr /i "PasswordComplexity ClearTextPassword" C:\secpol.txt

PasswordComplexity = 1
ClearTextPassword = 0

1 means complexity is on. 0 means reversible encryption is off.

Example

net accounts on a fresh image shows minimum length 0, maximum age 42, history 0. Every one of those is a finding. After the steps above, run it again and confirm all four lines changed.

Try it

  1. Set each value in secpol.msc, then run net accounts and match every line to the dialog.
  2. Set minimum length to 20 and try to change a test user's password to something shorter. Read the error, then set it back.

Build it

A policy.bat that sets the password policy with net accounts /minpwlen:12 /maxpwage:60 /minpwage:10 /uniquepw:24 and prints net accounts after. Complexity can't be set with net accounts; add a secedit import for that once you've learned the export format on the Verify page.

Next

Lockout Policy