# Ensure 'Minimum password length' is set to '12 or more character(s)'

Necessity: The minimum password length is a fundamental security control that dictates the baseline complexity of user passwords. Longer passwords exponentially increase the number of possible character combinations, making them significantly more resistant to brute-force, dictionary, and rainbow table attacks. A weak password length policy can allow attackers to compromise accounts with relative ease, leading to unauthorized access, data breaches, and privilege escalation. Auditing and Remediation: The audit script inspects the system's security database to retrieve the currently configured value for 'MinimumPasswordLength'. The remediation script directly modifies this policy setting, enforcing the new length requirement for all future password changes. Recommended State Rationale: Basic [12, 12]: This state meets the minimum recommended length by many security standards, providing a reasonable defense against casual brute-force attacks. Moderate [14, 14]: Increasing the length to 14 characters significantly enhances security, aligning with stricter guidelines from organizations like NIST. This length makes password cracking computationally more expensive for attackers. Strict [16, 'upper bound']: A minimum length of 16 or more characters is considered a best practice for high-security environments. It renders brute-force attacks practically infeasible with current technology, providing robust protection for critical systems and sensitive data.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[12, 'upper bound']` |
| **Moderate** | `[14, 'upper bound']` |
| **Strict** | `[16, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that queries the local security policy for the 'Minimum password length' setting. The script should parse the output to extract only the numeric value of the setting and print it to standard output. For example, if the setting is 12, the script must output only '12'.

## Remediation Script Working

PowerShell script that configures the 'Minimum password length' security policy. The script must accept a single, positional command-line argument representing the desired password length (e.g., `script.ps1 14`). The script will use this value to update the local security policy. It must output `$true` if the configuration is successful and `$false` if it fails.

