Password Policy Check Reference

Configuration options for the Password Policy Check

Written By Erdinc Akay

Last updated 26 days ago

Password Policy Check Reference

The Password Policy Check verifies local password policy settings on Windows devices and alerts when they fall below the configured security thresholds.

Configuration fields

Field	Type	Required	Default	Description
Minimum password length	Integer	No	12	Minimum number of characters required by the policy
Maximum password age (days)	Integer	No	90	Maximum days until password expiry
Maximum lockout threshold	Integer	No	5	Warn if the lockout threshold allows more failed attempts than this value (or if account lockout is disabled entirely). This is an upper bound on permitted attempts, not a minimum.
Require password history	Boolean	No	Yes	Requires the policy to enforce password history

The run interval is not a field on this check's configuration panel. The check runs every 1440 minutes (daily); the interval is fixed by the check definition and is not user-configurable.

Collected metrics

Password length (minimum required characters)
Max age (days until password expiry)
Lockout threshold (failed attempts permitted before lockout)
Lockout duration (minutes)
History length (number of previous passwords remembered)

Detected issues

For each policy setting that fails the configured thresholds, the check emits one issue row with the following fields:

Field	Type	Description	Example
Setting	String	Which policy setting failed (e.g. password length, max age, lockout threshold).	Minimum password length
Current value	String	The value read from the local security policy.	8
Expected value	String	The threshold the check requires.	12
Severity	Enum	Result severity assigned to this issue.	Warning

Platform support

Platform	Supported
Windows	Yes
Linux	No
macOS	No

Notes

The check reads the local password and lockout policy directly from Windows. On domain-joined machines, the effective policy may come from Group Policy.
The check verifies policy settings, not the actual passwords of user accounts.
Requires administrator privileges (the agent runs as Local System by default).