Set a Strong Password Policy on Windows Server

Your server is on the internet, and Remote Desktop is a favourite target for password-guessing bots. A password policy makes sure every local account, not just yours, uses a password that is hard to guess. This guide sets the policy with the graphical tool or one command, explains which settings matter most today, and tests the result.

Before you start

Administrator access over Remote Desktop to 203.0.113.10:3389.
A list of who uses the server. A stricter policy affects their next password change.
The policy applies to local accounts on a standalone server, which is how servers are set up.

Note: A new policy does not force existing passwords to change. It applies the next time a password is set. To bring weak passwords up to standard, ask users to change them after you set the policy.

What modern advice says

Current guidance from security bodies such as NIST has moved away from short, complex passwords that change every month. In short:

Length matters most. A passphrase of four or five random words is stronger and easier to remember than P@ssw0rd!.
Do not force regular changes unless a password may have leaked. Frequent forced changes lead to predictable patterns like Summer2026! then Autumn2026!.
Block reuse of recent passwords.
Use a password manager so each server has a unique password.
Combine with a lockout policy so guessing stops after a few attempts.

The settings

All password settings are in Local Security Policy under Account Policies → Password Policy:

Minimum password length: the most important one. 14 is the highest value on many Windows versions. Recent versions also have a Relax minimum password length limits setting that allows longer minimums.
Password must meet complexity requirements: needs three of four character types (upper case, lower case, digits, symbols) and blocks passwords containing the account name. Enabled by default on Windows Server.
Enforce password history: how many old passwords Windows remembers to prevent reuse. 24 is the maximum.
Maximum password age: days before a password expires. 0 means never.
Minimum password age: days before a user can change the password again. This stops people cycling through history to reuse an old password.
Store passwords using reversible encryption: keep this Disabled.

A sensible starting point for a small server:

Minimum length: 14
Complexity: Enabled
History: 24
Maximum age: 0 (never) or 365, if your own rules require expiry
Minimum age: 1 day

Set it with Local Security Policy

Press Win + R, type secpol.msc and press Enter.
Open Account Policies → Password Policy.
Double-click each setting, enter the value and click OK.
Run gpupdate /force in an elevated prompt to apply it immediately.

Set it with net accounts

net accounts sets length, age and history from one command. Open Command Prompt or PowerShell as Administrator:

CMD

net accounts /minpwlen:14 /uniquepw:24 /minpwage:1 /maxpwage:unlimited

/minpwlen is the minimum length.
/uniquepw is the password history count.
/minpwage and /maxpwage are in days. unlimited means passwords never expire.

net accounts cannot turn complexity on or off. Use secpol.msc for that.

To view the current policy:

CMD

net accounts

Example output:

Minimum password age (days):                          1
Maximum password age (days):                          Unlimited
Minimum password length:                              14
Length of password history maintained:                24
Lockout threshold:                                    5

Warning: If you set a maximum password age, make sure the Administrator account's password will not silently expire while you rely on it. An expired password on the only admin account can block Remote Desktop sign-in. Keep a tested backup administrator account.

Test the change

Try setting a password that breaks the policy on a test account. In an elevated prompt:

PowerShell

$pw = Read-Host -AsSecureString "Enter a short password to test"
New-LocalUser -Name "policytest" -Password $pw

Enter something short such as abc123. Windows should refuse it with an error saying the password does not meet the policy requirements. Then try a long passphrase, which should be accepted. Remove the test account afterwards:

PowerShell

Remove-LocalUser -Name "policytest"

Run net accounts again to confirm the values you set.

Troubleshooting

Settings are greyed out in secpol.msc: a Group Policy controls them. Run gpresult /r to see which one.
A user can no longer change their password: the new password is too short, matches history, or the minimum age has not passed. Explain the rules, or reset it yourself as an admin.
Password expired and RDP shows an error: see Fix an expired password on Remote Desktop.
net accounts returns "System error 5": the prompt is not elevated. Reopen it with Run as administrator.

Next steps

Stop guessing attempts: Set an account lockout policy against RDP password guessing.
Change the password the server shipped with: Change your Windows server password safely.

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket