Enforce Password Age and Complexity in Windows 11

Securing local user accounts on Windows 11 involves configuring system policies to enforce password complexity and establish a maximum password age. This guide details how to configure these security policies using the Local Group Policy Editor in Windows 11 Pro and Enterprise editions, as well as how to manage password expiration via the Command Prompt for Windows 11 Home users.

Method 1: Using Local Group Policy Editor (Windows 11 Pro, Enterprise, and Education)

The Local Group Policy Editor provides the most direct way to enforce both complexity rules and password expiration periods.

  1. Press Win + R, type gpedit.msc, and press Enter to launch the Local Group Policy Editor.
  2. Navigate to the following path in the left pane: Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy
  3. Enable Password Complexity:
    • Double-click Password must meet complexity requirements in the right pane.
    • Select Enabled and click Apply, then OK.
    • Note: When enabled, passwords must be at least six characters long and contain characters from three of the following categories: uppercase letters, lowercase letters, numbers, and non-alphanumeric characters (symbols).
  4. Set Maximum Password Age:
    • Double-click Maximum password age.
    • Enter the number of days a password can be used before Windows forces the user to change it (commonly between 30 and 90 days).
    • Click Apply, then OK.
  5. Close the Local Group Policy Editor and restart your computer, or run gpupdate /force in an elevated Command Prompt to apply the changes immediately.

Method 2: Using Command Prompt (Windows 11 Home, Pro, and Enterprise)

Windows 11 Home does not include the Local Group Policy Editor. However, you can enforce the maximum password age using the Command Prompt.

  1. Click the Start button, type cmd, right-click Command Prompt, and select Run as administrator.

  2. To set the maximum password age, type the following command and press Enter:

    net accounts /maxpwage:XX

    (Replace XX with the desired number of days, such as 60 or 90.)

  3. To verify the change, run:

    net accounts

    The output will display the active policy under Maximum password age (days).