# Ensure 'Maximum password age' is set to '90 days, but not 0'

The 'Maximum password age' policy determines the period of time (in days) that a password can be used before the system requires the user to change it. Its necessity lies in mitigating the risk associated with compromised credentials. By enforcing regular password changes, it limits the window of opportunity for an attacker to use a stolen password for unauthorized access. A misconfiguration, especially setting the value to 0 (which means the password never expires), significantly increases the risk of persistent unauthorized access and password-related attacks like credential stuffing. The audit script checks the current value by parsing the output of the `net accounts` command. The remediation script uses the same command with the `/maxpwage` parameter to enforce a specific password expiration policy. The recommended states are justified as follows: Basic `[1, 90]` aligns with common industry frameworks like CIS, balancing security with user experience by requiring quarterly changes. Moderate `[1, 60]` enhances security by shortening the credential exposure window to two months, suitable for environments with sensitive data. Strict `[1, 30]` is recommended for high-value systems and privileged accounts, as the monthly rotation drastically reduces the risk from compromised credentials.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[1, 90]` |
| **Moderate** | `[1, 60]` |
| **Strict** | `[1, 30]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that executes the `net accounts` command and parses the output to extract the numeric value for 'Maximum password age (days)'. The script must return only the integer value, with no additional text or formatting. For example, if the setting is 90, the script should output `90`.

## Remediation Script Working

PowerShell script that accepts a single integer as a positional command-line argument. The script must use this argument to set the 'Maximum password age' using the `net accounts /maxpwage:<days>` command. It must return `$true` on successful execution and `$false` on failure. The script should handle invalid inputs, such as 0, as a failure.

