Inspector for "Password complexity" on Windows endpoints

[jmcbride]

Hello,
For Windows OS, is there a way to check if “password complexity” is enabled?

Possible values
Enabled
Disabled
Not defined
May be stored in stored in Passfilt.dll.

I do not see it as part of the “security database” inspector.

Thanks,
John

[brolly33]

John,

I agree that the Security Database object does not seem to have a property for Password Complexity on Windows.

You might want to look into a WMI RSOP call as is mentioned in this old 2010 post:

RSOP WMI Question

(imported topic written by MichaelG91) Recently I’ve been working on some fixlets that need to access some values from the local group policies. I’ve been having a little trouble getting to: Security Settings -> Account Policies -> Password Policy -> Password Must Meet Complexity Requirements. Now I’ve looked through the windows inspector reference and found that this key is missing from the security database that’s supported directly through BigFix. In addition according to Microsoft there…

If you have the BigFix Compliance content, this Fixlet is available in that content stream under several of the Windows based standards.

[jmcbride]

Thanks Brolly for confirming password complexity not an available property in the security database object. Will check the post you suggested.
Thanks,
John

[jgstew]

If this GPO sets something in the registry somewhere, then it may be possible to look for the effect of it that way, otherwise you may need something like RSOP as already mentioned.

Seems like these might be found here: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SecEdit\Reg Values

• https://social.technet.microsoft.com/Forums/en-US/e0a5530f-ecb7-4e1a-98d3-c422dcbb3921/registry-path-for-password-complexity-and-storing-passwords-using-reversible-encryption?forum=winservergen

This seems to be a command line option to get some of this as well:

secedit /export /cfg C:\securityconfig.cfg

• https://social.technet.microsoft.com/Forums/windowsserver/en-US/0d1067a8-4897-428c-abea-72a9f4454f04/password-complexity?forum=winservercore

[jmcbride]

Looks like we have the paid for content that includes a check for Password complexity. Its a two step process, collecting the data, then reading an output file with an analysis. Thanks all for the help.