# Password Policy

> Enforce a password or PIN policy and automatic screen lock on Windows Devices with the Passcode configuration in Applivery.

Source: https://docs.applivery.com/en/device-management/windows/policies/password-policy/  •  Last updated: 2026-10-16

**Key topics:** Passcode configuration, Password length, complexity and expiration, Password history and screen lock, Reviewing OMA URIs, Applivery, Windows, Microsoft Entra ID, BitLocker, OMA URI, CSP

---

**TL;DR:** Turn on Device Password Enabled in the Passcode configuration, then set length, complexity, expiration, history and screen lock for local accounts on Windows.

Enforce a password or PIN policy and automatic screen lock on your Windows Devices with the **Passcode** configuration.

## Requirements

-   Windows 10 1507 or later, or Windows 11, in any edition.
    
-   The rules apply to **local accounts**. Microsoft Entra ID and domain accounts follow the password policy of their own directory.
    

## Configure the password policy

**Create or open the Windows Policy**

Once in the [**Applivery Dashboard**](https://dashboard.applivery.io/), head to **Policies** 1. Choose the Policy where you want to add this configuration. In the left-hand menu, select **\+ Add configuration** 2, and search for **Passcode** 3.

![passcode](https://docs.applivery.com/int/_r2/media/09ac0a4e-3ad8-478f-9f15-3474973eec71/d8c14a62-d92e-4360-9df4-78d9fa8a5f25.png)

**Turn on the password requirement**

In **Basic requirements**:

1.  Set **Device Password Enabled** to **0 Enabled**. This is the main switch: while it stays on **1 Disabled**, which is the default, every other rule in the form is ignored.
    
2.  Set **Allow Simple Device Password** to **0 Not allowed** to block trivial PINs like 1111 or 1234, and picture passwords on desktop.
    

![basic requirements](https://docs.applivery.com/int/_r2/media/09ac0a4e-3ad8-478f-9f15-3474973eec71/e38b011b-5252-4842-a96a-444697054bce.png)

**Define length, complexity and expiration**

1.  **Alphanumeric Device Password Required**: **0 Password or Alphanumeric PIN required**.
    
2.  **Min Device Password Length**: 12. The default value is 4.
    
3.  **Min Device Password Complex Characters**: **2 Digits and lowercase letters are required**.
    
4.  **Device Password Expiration**: 90 days. Leave it empty so the password never expires.
    

![other configs](https://docs.applivery.com/int/_r2/media/09ac0a4e-3ad8-478f-9f15-3474973eec71/65b9dd3c-ed3d-41d1-a5e7-6608e15ddecd.png)

The complexity dropdown shows which values Windows accepts on desktop. Values **3** and **4** are marked in the list itself as not supported for desktop accounts, so stick to **1** or **2** on PCs.

**Set password history and screen lock**

Scroll to the end of **Basic requirements** and configure **Lock and unlock**:

1.  **Device Password History**: 5. Users can't reuse their last five passwords.
    
2.  **Max Inactivity Time Device Lock**: 5 minutes. The Device locks and asks for the password after that much inactivity.
    
3.  **Max Device Password Failed Attempts**: 10. On desktop, this does **not** wipe the Device: it sends it to BitLocker recovery, and it only works if [BitLocker](https://docs.applivery.com/en/device-management/windows/policies/deploy-bitlocker/) is turned on.
    

![lock and unlock](https://docs.applivery.com/int/_r2/media/09ac0a4e-3ad8-478f-9f15-3474973eec71/941ea8eb-164e-4799-8aaf-f2e8d312deb0.png)

**Review, save and assign**

1.  Open **Summary** and set **View summary as** **OMA URIs** to check the exact nodes and values that will be sent to the Device.
    
2.  Click **Save changes**. Nothing reaches the Devices until you save. If you leave the page before saving, Applivery asks whether you want to discard the draft.
    
3.  Assign the Policy to a Device from **Assigned devices** by clicking **+ Assign to device**, or to a group or Segment.

## What the user experiences

If the user's current password doesn't meet the Policy, Windows asks them to change it at their next sign-in.

## Notes

-   Microsoft only documents **Allow Idle Return Without Password** for HoloLens.
    
-   There is no CSP to unlock a locked local account remotely. This Policy only prevents and limits failed attempts.