Enable Password Complexity via Registry Editor

This article provides a direct guide on how to configure Windows Local Security Policy to enforce password complexity for local accounts using the Windows Registry Editor (regedit). While complexity rules are usually applied using the Local Security Policy console (secpol.msc), administrators working on Windows Home editions or automated environments can achieve the same security enforcement by registering the built-in Windows password filter module directly in the registry.

Requirements Enforced by Default Complexity

Enabling the default Windows complexity filter enforces the following rules for all local user accounts: * Passwords must be at least six characters long. * Passwords must contain characters from at least three of the following four categories: English uppercase characters (A–Z), English lowercase characters (a–z), base 10 digits (0–9), and non-alphanumeric characters (such as !, $, #, %). * Passwords cannot contain the user’s account name or parts of the user’s full name that exceed two consecutive characters.

Step-by-Step Registry Configuration

1. Open Registry Editor
   • Press Windows Key + R to open the Run dialog.
   • Type regedit and press Ctrl + Shift + Enter (or click OK) to run it as an Administrator.
   • Select Yes if prompted by User Account Control (UAC).
2. Navigate to the LSA Key

   • In the address bar at the top of the Registry Editor, paste the following path and press Enter:

     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

3. Modify the Notification Packages Entry

   • In the right-hand pane, locate the multi-string value named Notification Packages.

   • Double-click Notification Packages to open the Edit Multi-String dialog.

   • On a new line below any existing entries (such as scecli), type:

     PASSFILT

   • Click OK to save the changes.

4. Restart the System
   • Close the Registry Editor.
   • Restart the computer to apply the updated Local Security Authority (LSA) notification packages.

Verification and Reverting

• To test the policy: Attempt to change a local user’s password to a simple phrase (e.g., password123 or test). Windows will return an error stating that the password does not meet the complexity requirements.
• To disable the policy: Reopen the Notification Packages value in the same registry location, remove the PASSFILT line, click OK, and restart the computer.