0
I'm testing a password policy for a small workgroup. The W10 Pro VM I'm testing it on has two users (both Local, Admin privs). One profile has a password and one does not.
After logging into the user profile that has a simple password I ran secpol.msc and configured the following items as shown:
Security Settings > Account Policy > Password Policy
- Maximum password age: 90 days
- Minimum password age: 5
- Minimum password length: 14
- Password must meet complexity requirements: Enabled
- Enforce Password History: 12
I also configured Local Policies > Security Options > Interactive
- Logon:Prompt user to change password before expiration: 14
After rebooting I logged in with the original simple password, wondering when I might be prompted to change it to the complex password.
I then logged out and logged into the other user profile that has no password. There was no notification about requiring a password.
Is there a policy setting to require all users to create a new password after you establish password policies, or is the only solution to go to Computer Management > Local Users and Groups > Users and enable "User must change password at next logon" in each user's properties?
You set the minimum password age to 5 days but did all your tests immediately. The conclusion is simple. You need to wait 5 days. You can also just set the time on the NTP server forward 5 days then manually update the clock on the client. If you want the new policy to be enforced immediately force the password change immediately – Ramhound – 2017-08-02T03:50:48.193
@Ramhound: This would have been better as an answer. – harrymc – 2017-08-02T09:26:10.313