# Ensure 'Minimum password length' is set to '12 or more character(s)'

Necessity: The minimum password length is a fundamental security control that dictates the baseline complexity and strength of user passwords. Longer passwords are exponentially more difficult to crack using brute-force, dictionary, or rainbow table attacks. A short minimum password length significantly increases the risk of unauthorized account access, potentially leading to data breaches, privilege escalation, and system compromise. Auditing and Remediation: The audit script checks the current system configuration by parsing the output of the 'net accounts' command to isolate the currently configured minimum password length. The remediation script directly modifies this setting using the 'net accounts /minpwlen:<value>' command, enforcing the specified length as the new system-wide policy. Recommended State Rationale: Basic ([12, 12]) establishes a strong baseline, moving beyond outdated 8-character recommendations and aligning with modern security practices like those from NIST for providing substantial protection. Moderate ([14, 14]) further increases security, making brute-force attacks significantly more time-consuming and computationally expensive. Strict ([16, 'upper bound']) offers a very high level of protection, recommended for systems with highly sensitive data or for privileged administrator accounts, as it makes brute-force attacks practically infeasible with current technology.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[12, 'upper bound']` |
| **Moderate** | `[14, 'upper bound']` |
| **Strict** | `[16, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that retrieves the 'Minimum password length' value by parsing the output of the 'net accounts' command. The script must return only the numerical value.

## Remediation Script Working

PowerShell script that accepts a single integer as a positional command-line argument. The script must use this argument to set the 'Minimum password length' via the 'net accounts /minpwlen:<value>' command. It must return $true upon successful execution and $false otherwise.

