Windows has hundreds of security settings, and the Local Security Policy is where many of them live. In this lesson you will learn the policies that matter most for a beginner: password policy, account lockout and a few key options.
Safety note: change policies only on your own practice VM, from a snapshot. A bad lockout setting can lock you out of your own machine.
Opening the Local Security Policy
Press Win+R, type secpol.msc and press Enter. (Windows Home does not include this tool.) The left pane has folders. The ones you need first are:
- Account Policies, which holds Password Policy and Account Lockout Policy.
- Local Policies, which holds Audit Policy, User Rights Assignment and Security Options.
Changes take effect for new sign-ins or after you run gpupdate /force in an administrator Command Prompt.
Password policy
Go to Account Policies > Password Policy. Common sensible settings for a practice scenario:
- Enforce password history: 24 passwords remembered, so people cannot cycle back to an old one.
- Maximum password age: 60 to 90 days.
- Minimum password age: 1 or more days, so users cannot change a password many times to get back to the old one.
- Minimum password length: 10 to 14 characters. Longer is better than complicated.
- Password must meet complexity requirements: Enabled.
- Store passwords using reversible encryption: Disabled. This setting is almost never wanted.
Always follow the numbers in your scenario README if they differ. A long passphrase such as four unrelated words is easier to remember and harder to guess than a short, complex password.
Account lockout policy
Go to Account Policies > Account Lockout Policy. It slows down people who guess passwords.
- Account lockout threshold: 5 to 10 invalid attempts.
- Account lockout duration: 15 to 30 minutes.
- Reset account lockout counter after: 15 to 30 minutes.
Set the threshold too low and a user who mistypes twice is locked out, so pick a balance.
Local Policies and Security Options
Under Local Policies > Audit Policy, turn on auditing for logon events and account management for success and failure. This feeds the Event Viewer, which you will use in a later lesson.
Under Local Policies > Security Options, useful hardening settings include:
- Accounts: Guest account status: Disabled.
- Accounts: Limit local account use of blank passwords to console logon only: Enabled.
- Interactive logon: Do not display last user name: Enabled.
- Interactive logon: Do not require CTRL+ALT+DEL: Disabled.
- Network access: Do not allow anonymous enumeration of SAM accounts and shares: Enabled.
Under User Rights Assignment, review who may “Access this computer from the network” and “Allow log on locally”. Remove accounts that do not need these rights.
Checking your work
You can view the effective settings without changing them:
net accounts
gpresult /rnet accounts prints the password and lockout settings currently in effect. Write down each setting before and after you change it so you can undo mistakes.
Check your understanding
1. Which tool opens the Local Security Policy?
- lusrmgr.msc
- secpol.msc
- eventvwr.msc
- services.msc
Answer: secpol.msc. It opens the console for account, audit and security option settings.
2. Why set a minimum password age?
- So passwords expire faster
- So users cannot change passwords repeatedly to return to an old one
- So accounts are locked
- To disable complexity
Answer: So users cannot change passwords repeatedly to return to an old one. It works together with password history.
3. What does an account lockout threshold control?
- How long a password is
- How many failed sign-in attempts are allowed before the account locks
- How many users can sign in
- When updates install
Answer: How many failed sign-in attempts are allowed before the account locks. It slows down password guessing.
4. Which command shows the password and lockout settings in effect?
- net accounts
- ipconfig
- tasklist
- ping
Answer: net accounts. It lists minimum length, maximum age and lockout settings.