# Ensure 'Password must meet complexity requirements' is set to 'Enabled'

Necessity: Enabling password complexity is a fundamental security control that mitigates the risk of brute-force and dictionary attacks. It forces users to create stronger passwords that are not easily guessable, by requiring them to contain characters from at least three of the following five categories: uppercase letters, lowercase letters, digits, non-alphanumeric characters, and Unicode characters. Failure to enforce complexity leaves accounts highly susceptible to compromise from trivial password guessing attempts.

Auditing and Remediation: The audit script inspects the local security database to determine the current status of the 'PasswordComplexity' policy flag. The remediation script modifies this flag, typically using the 'secedit' command-line tool, to set the policy to the desired state (1 for Enabled, 0 for Disabled).

Recommended State Rationale: 
Basic: ['Enabled'] - This is the minimum acceptable security posture, aligning with nearly all security benchmarks, including CIS. It establishes a baseline defense against weak passwords.
Moderate: ['Enabled'] - For this binary setting, there is no intermediate state. 'Enabled' remains the only effective configuration for moderate hardening.
Strict: ['Enabled'] - In the most stringent security environments, this setting must be enabled. Its effectiveness is amplified when combined with strong password length and history policies, but for this specific policy, 'Enabled' is the only recommended state across all levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the local security policy for the 'Password must meet complexity requirements' setting. The script must return only the current state as a single string: 'Enabled' or 'Disabled'.

## Remediation Script Working

Develop a PowerShell script that accepts a single positional command-line argument, which must be either 'Enabled' or 'Disabled'. The script will configure the 'Password must meet complexity requirements' setting to match the provided argument. It must return $true upon successful application of the setting, and $false otherwise.

