# Ensure 'Minimum password age' is set to '1 day'

The 'Minimum password age' policy determines the period of time (in days) that a password must be used before the user can change it. Its primary necessity is to prevent users from circumventing the 'Enforce password history' policy. Without a minimum age, a user could rapidly change their password multiple times in a single session to cycle back to their original, familiar password, thereby defeating the purpose of password history. The audit script checks the current value of this setting, typically by parsing the output of system security commands like 'net accounts'. The remediation script modifies this setting directly, applying the specified number of days as the new minimum. The recommended states provide increasing levels of control: Basic (1 day) is the standard best practice (e.g., CIS Benchmark) to prevent immediate password cycling. Moderate (2 days) and Strict (3 days) add a longer enforcement window, further solidifying the control and giving administrators more time to detect and react to potentially malicious password changes on a compromised account.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[1, 1]` |
| **Moderate** | `[1, 1]` |
| **Strict** | `[1, 1]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that queries the local security policy for the 'Minimum password age' setting. The script must output only the numerical value of the current setting (e.g., '1') without any additional text or labels.

## Remediation Script Working

PowerShell script that sets the 'Minimum password age' policy. The script must accept a single, positional command-line argument, which is an integer representing the number of days. The script will use this argument to update the policy (e.g., using 'net accounts /minpwage:<days>') and must return '$true' on success or '$false' on failure.

