Verify Both Policies¶
Don't trust the dialog. Read the values back from the same place Windows reads them.
net accounts¶
Shows lockout settings and most password settings in one screen.
net accounts
Force user logoff how long after time expires?: Never
Minimum password age (days): 10
Maximum password age (days): 60
Minimum password length: 12
Length of password history maintained: 12
Lockout threshold: 5
Lockout duration (minutes): 30
Lockout observation window (minutes): 30
Computer role: WORKSTATION
Compare each line to the Use column on the two previous pages.
secedit export¶
Shows everything, including the two settings net accounts skips.
secedit /export /cfg C:\secpol.txt
notepad C:\secpol.txt
Find the [System Access] section:
[System Access]
MinimumPasswordAge = 10
MaximumPasswordAge = 60
MinimumPasswordLength = 12
PasswordComplexity = 1
PasswordHistorySize = 12
LockoutBadCount = 5
ResetLockoutCount = 30
LockoutDuration = 30
AllowAdministratorLockout = 1
ClearTextPassword = 0
| Key | Means |
|---|---|
PasswordComplexity = 1 |
Complexity enabled |
ClearTextPassword = 0 |
Reversible encryption disabled |
LockoutBadCount |
Lockout threshold |
ResetLockoutCount |
Reset counter after |
AllowAdministratorLockout = 1 |
Administrator can be locked out |
Delete C:\secpol.txt when done.
When a value won't stick¶
If you set something and the readback still shows the old value:
- You may have clicked OK on the inner dialog but Cancel on the outer one. Reopen and check.
- Minimum age greater than or equal to maximum age is rejected silently in some paths. Set max first, then min.
- On a domain-joined machine, domain Group Policy overrides local policy. Run
gpresult /rto see which policies apply. On a competition workstation this is rare. - Run
gpupdate /forceand check again.