Password Policy Script Generator

Industry Presets

Click any industry button to review the policy in a modal. Choose Accept & Apply to inject the settings into the form.

Target

Deployment Mode Use Local Security Policy for standalone/member servers. Use Default Domain Password Policy for domain-wide password policy in Active Directory.

Password Settings

Minimum password length

Password history remembered

Minimum password age (days)

Maximum password age (days)

Password must meet complexity requirements

Store passwords using reversible encryption

Account Lockout

Account lockout threshold

Account lockout duration (minutes)

Reset account lockout counter after (minutes)

Force Password Change

Force Change Mode Use this to force users to change passwords now or on a scheduled date. Date-based forcing is only available in domain mode.

End-User Notification

Generate end-user notification logic

Script Options

Include basic validation checks

Include comments in generated script

Important: Domain mode can generate logic to target users by OU or group, force password changes now or on a specific date, and optionally notify users by email before expiration or a forced change date.

Note: Active Directory does not natively store a future “force password change on this date” field. The generated domain script handles that by creating a scheduled task that sets ChangePasswordAtLogon on the selected date.

Generated PowerShell

Click "Generate Script" to build your PowerShell script.