# Ensure 'Password must meet complexity requirements' is set to 'Enabled'

Necessity: Enforcing password complexity is a fundamental security control that significantly increases the difficulty of password-guessing attacks, including brute-force and dictionary attacks. It requires passwords to contain a mix of character types (e.g., uppercase letters, lowercase letters, numbers, symbols), preventing users from choosing simple, common, or easily crackable passwords. Disabling this setting makes user accounts highly vulnerable to compromise. Auditing and Remediation: The audit script verifies the current state of the password complexity requirement by checking the local security policy. The remediation script directly modifies this policy to either enable or disable the requirement based on the provided argument. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Enabled'. This is a binary, foundational security setting with no acceptable intermediate state. Enabling it is a baseline requirement in virtually all security frameworks, including CIS Benchmarks and NIST. Any deviation from 'Enabled' represents a significant and unnecessary security risk, regardless of the environment's overall security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that executes the `net accounts` command. The script must parse the output to locate the line 'Password must meet complexity requirements' and extract its value. The script should return 'Enabled' if the value is 'Yes', and 'Disabled' if the value is 'No'. The script's output must consist solely of the current state string.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which must be either 'Enabled' or 'Disabled'. The script will translate this argument to the appropriate value ('YES' for 'Enabled', 'NO' for 'Disabled') and use the `net accounts /COMPLEXITY:<value>` command to configure the system setting. The script must return `$true` upon successful execution and `$false` if an error occurs or the input is invalid.

