# Ensure 'Maximum password age' is set to '90 days, but not 0'

Necessity: The 'Maximum password age' policy determines the period of time (in days) that a password can be used before the system requires the user to change it. This is a critical security control that mitigates the risk of compromised credentials. By forcing periodic password changes, it limits the duration an attacker can use a stolen password for unauthorized access. A setting of 0, which means the password never expires, creates a permanent window of vulnerability if that credential is ever compromised. Auditing and Remediation: The audit script instruction is designed to query the system's current 'Maximum password age' value by parsing the output of the `net accounts` command. The remediation script instruction uses the same command (`net accounts /maxpwage`) to directly configure the setting to a desired value provided as an argument. Recommended State Rationale: The recommended states are based on a balance of security and usability. Basic: [1, 90] aligns with common industry practices and standards, providing a reasonable period before a password must be changed. Moderate: [1, 60] enhances security by shortening the credential's lifespan, reducing the exposure time for compromised accounts, and is often a requirement in more regulated environments. Strict: [1, 30] offers the highest level of security by enforcing frequent password rotation, which is suitable for systems handling highly sensitive data where the risk of credential compromise must be minimized as much as possible.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[1, 90]` |
| **Moderate** | `[1, 60]` |
| **Strict** | `[1, 30]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that executes the `net accounts` command. The script must parse the output to locate the 'Maximum password age (days)' setting and return only its corresponding numeric value.

## Remediation Script Working

PowerShell script that accepts a single integer as a positional command-line argument, representing the desired maximum password age in days. The script must use the `net accounts /maxpwage:<value>` command to apply the new setting. It must return `$true` if the command's exit code is 0 (success), and `$false` otherwise.

