Password Policy¶
Password policy forces every account on the machine to meet a minimum. Without it, a user can set their password to a.
Where it is¶
secpol.msc → Account Policies → Password Policy. Double-click a setting to change it.
On a Server 2022 domain controller, the policy that applies to domain accounts is in gpmc.msc → Default Domain Policy → Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies. Same settings, different tool.
The settings¶
Each has a floor and a ceiling. Too low is useless; too high pushes people to write passwords down. The "Use" column is the middle of what security baselines (Microsoft, CIS, DISA STIG) call reasonable.
| Setting | What it does | Reasonable range | Use |
|---|---|---|---|
| Enforce password history (1.1.2) | How many old passwords are remembered and can't be reused | 10 to 24 (STIG: 24) | 12 |
| Maximum password age (1.1.1) | Days before a password must be changed | 30 to 90 (STIG: 60 or less) | 60 |
| Minimum password age (1.1.3) | Days a user must keep a new password before changing again. Without it, a user changes their password 12 times in a row to get back to the old one. | 10 to 30 | 10 |
| Minimum password length (1.1.4) | Fewest characters allowed | 10 to 20 (STIG: 14) | 12, or 14 for a STIG baseline |
| Password must meet complexity requirements (1.1.5) | Three of: uppercase, lowercase, digits, symbols. Also blocks passwords containing the username. | Enabled | Enabled |
| Store passwords using reversible encryption (1.1.7) | Stores passwords so they can be decrypted, which defeats hashing | Disabled | Disabled |
Minimum age must be less than maximum age or Windows refuses the change. Windows caps history at 24.
One more setting in the same folder: Relax minimum password length limits (CIS 1.1.6) should be Enabled. Without it, Windows caps the minimum length policy at 14 characters; with it, you can require longer passwords if the organization's policy calls for them.
Warning
Reversible encryption is the one people miss. It defaults to Disabled, so nobody thinks to look. An image may have turned it on.
Step by step¶
- Open
secpol.msc. - Expand Account Policies, click Password Policy.
- Double-click Enforce password history, type
12, OK. - Maximum password age:
60. - Minimum password age:
10. - Minimum password length:
12. - Password must meet complexity requirements: Enabled.
- Store passwords using reversible encryption: Disabled.
Verify¶
net accounts
Minimum password age (days): 10
Maximum password age (days): 60
Minimum password length: 12
Length of password history maintained: 12
Complexity and reversible encryption don't show here. For those:
secedit /export /cfg C:\secpol.txt
findstr /i "PasswordComplexity ClearTextPassword" C:\secpol.txt
PasswordComplexity = 1
ClearTextPassword = 0
1 means complexity is on. 0 means reversible encryption is off.
Example¶
net accounts on a fresh image shows minimum length 0, maximum age 42, history 0. Every one of those is a finding. After the steps above, run it again and confirm all four lines changed.