You are here: Home > Device Management > Windows > Policies > Password Policy

Enforce a Password Policy on Windows Devices

Enforce a password or PIN policy and automatic screen lock on Windows Devices with the Passcode configuration in Applivery.

5 min read

TL;DR

Turn on Device Password Enabled in the Passcode configuration, then set length, complexity, expiration, history and screen lock for local accounts on Windows.

Enforce a password or PIN policy and automatic screen lock on your Windows Devices with the Passcode configuration.

Requirements

  • Windows 10 1507 or later, or Windows 11, in any edition.

  • The rules apply to local accounts. Microsoft Entra ID and domain accounts follow the password policy of their own directory.

Configure the password policy

1
Create or open the Windows Policy

Once in the Applivery Dashboard, head to Policies 1. Choose the Policy where you want to add this configuration. In the left-hand menu, select + Add configuration 2, and search for Passcode 3.

passcode
2
Turn on the password requirement

In Basic requirements:

  1. Set Device Password Enabled to 0 Enabled. This is the main switch: while it stays on 1 Disabled, which is the default, every other rule in the form is ignored.

  2. Set Allow Simple Device Password to 0 Not allowed to block trivial PINs like 1111 or 1234, and picture passwords on desktop.

basic requirements
3
Define length, complexity and expiration

  1. Alphanumeric Device Password Required: 0 Password or Alphanumeric PIN required.

  2. Min Device Password Length: 12. The default value is 4.

  3. Min Device Password Complex Characters: 2 Digits and lowercase letters are required.

  4. Device Password Expiration: 90 days. Leave it empty so the password never expires.

other configs

The complexity dropdown shows which values Windows accepts on desktop. Values 3 and 4 are marked in the list itself as not supported for desktop accounts, so stick to 1 or 2 on PCs.

4
Set password history and screen lock

Scroll to the end of Basic requirements and configure Lock and unlock:

  1. Device Password History: 5. Users can't reuse their last five passwords.

  2. Max Inactivity Time Device Lock: 5 minutes. The Device locks and asks for the password after that much inactivity.

  3. Max Device Password Failed Attempts: 10. On desktop, this does not wipe the Device: it sends it to BitLocker recovery, and it only works if BitLocker is turned on.

lock and unlock
5
Review, save and assign

  1. Open Summary and set View summary as OMA URIs to check the exact nodes and values that will be sent to the Device.

  2. Click Save changes. Nothing reaches the Devices until you save. If you leave the page before saving, Applivery asks whether you want to discard the draft.

  3. Assign the Policy to a Device from Assigned devices by clicking + Assign to device, or to a group or Segment.

What the user experiences

If the user's current password doesn't meet the Policy, Windows asks them to change it at their next sign-in.

Notes

  • Microsoft only documents Allow Idle Return Without Password for HoloLens.

  • There is no CSP to unlock a locked local account remotely. This Policy only prevents and limits failed attempts.

Key Takeaways

  • Device Password Enabled must be set to 0 Enabled or every other rule is ignored.
  • The rules apply to local accounts, not Entra ID or domain accounts.
  • On PCs, use complexity values 1 or 2.
  • Max Device Password Failed Attempts triggers BitLocker recovery, not a wipe.
  • Nothing reaches the Devices until you click Save changes.

Windows 10 version 1507 or later and Windows 11, in any edition.

No. The rules apply to local accounts. Microsoft Entra ID and domain accounts follow the password policy of their own directory.

Check that Device Password Enabled is set to 0 Enabled. While it stays on 1 Disabled, which is the default, every other rule in the form is ignored.

Set Allow Simple Device Password to 0 Not allowed. On desktop, this also blocks picture passwords.

Use 1 or 2 for Min Device Password Complex Characters. Values 3 and 4 are marked in the list itself as not supported for desktop accounts.

Not on desktop. When the limit is reached, the Device goes to BitLocker recovery, and this only works if BitLocker is turned on.

Only after you click Save changes and the Policy is assigned. If you leave the page before saving, Applivery asks whether you want to discard the draft.

No. There is no CSP to unlock a locked local account remotely. This Policy only prevents and limits failed attempts.

Was this page helpful?

Last updated: October 16, 2026