Windows Security · 2.3

🔐 Password & Lockout Policies

The settings that make passwords actually strong⏱ ~3 min

🏦Lockout policy = bank vault time-lock

A bank vault locks after too many wrong PIN attempts and makes you wait. Account lockout policy does the same thing — after 3-5 wrong passwords, the account locks for 30 minutes. Without this, an attacker can try millions of passwords (brute force) unimpeded.

Where to Configure: secpol.msc → Account Policies

All values below are drawn directly from CIS Microsoft Windows 10/11 Stand-alone Benchmark v3.0, Level 1. These are the same values CyberPatriot scoring aligns to.

Password Policy — CIS Level 1 (Windows 10/11)

SettingWhat It DoesCIS Level 1 Value
Enforce password historyPrevents reusing recent passwords24 or more passwords
Maximum password ageForces periodic password changes60 days (CIS allows up to 365; 60 is recommended)
Minimum password agePrevents cycling through history to reuse a favorite1 or more days
Minimum password lengthLonger passwords = exponentially harder to crack14 or more characters
Password must meet complexity requirementsEnforces uppercase + lowercase + digit + symbolEnabled
Store passwords using reversible encryptionStores decryptable plaintext — catastrophic if DB is stolenDisabled
⚠ Warning14 characters is the CIS Level 1 floor — not 8, 10, or 12. A minimum below 14 is considered a misconfiguration by the benchmark. A 10-character minimum does not meet CIS Level 1 and will not earn full points.
Time for an attacker to brute-force your password 🔨6 chars, lowercaseinstant8 chars, lowercaseseconds8 chars, mixed+symbols~8 hours12 chars, mixed+symbols~200 years14 chars, mixed+symbolsmillions of yearsThis is why CIS requires 14+ characters. Every character multiplies the attacker's work.
Why 14 characters: every character multiplies the attacker's work exponentially

Account Lockout Policy — CIS Level 1 (Windows 10/11)

SettingWhat It DoesCIS Level 1 Value
Account lockout thresholdLocks account after N failed attempts, defeating brute force5 or fewer invalid logon attempts
Account lockout durationHow long the account stays locked (0 = admin must unlock)15 minutes or more
Reset account lockout counter afterFailed-attempt counter resets after this period with no failures15 minutes or more

Command Line (net accounts)

cmd
# View current password policy
net accounts
 
# CIS Level 1: minimum password length = 14
net accounts /minpwlen:14
 
# CIS Level 1: enforce history of 24 passwords
net accounts /uniquepw:24
 
# Set maximum password age to 60 days (CIS allows up to 365; 60 is best practice)
net accounts /maxpwage:60
 
# CIS Level 1: minimum age 1 day
net accounts /minpwage:1
 
# CIS Level 1: lockout threshold 5 or fewer
net accounts /lockoutthreshold:5
 
# CIS Level 1: lockout duration 15+ minutes
net accounts /lockoutduration:15
 
# CIS Level 1: reset counter after 15+ minutes
net accounts /lockoutwindow:15
🔒 SecurityAlways set 'Store passwords using reversible encryption' to DISABLED. If enabled, Windows stores a decryptable copy of every password — if the password database is stolen, all passwords are exposed in plaintext.
🧠Quick Checkfirst try = +5 XP

Setting account lockout threshold to 0 does what?

🎮 Practice what you learned
🏰
Password Fort
Build passwords that survive a brute-force siege
→🕵️
Log Analysis
Hunt attackers through real firewall & access logs
→
⭐ 0 XP🔥 0 days
Open the full interactive CyberPatriot Prep module →