Password Policy Script Generator

Industry Presets

Click any industry button to review the policy in a modal. Choose Accept & Apply to inject the settings into the form.

Target

Deployment ModeUse Local Security Policy for standalone/member servers. Use Default Domain Password Policy for domain-wide password policy in Active Directory.

GPO / Policy NameUsed to name artifacts and, when selected below, create a new GPO object.

Password Settings

Minimum password length

Password history remembered

Minimum password age (days)

Maximum password age (days)

Password must meet complexity requirements

Store passwords using reversible encryption

Account Lockout

Account lockout threshold

Account lockout duration (minutes)

Reset account lockout counter after (minutes)

Force Password Change

Force Change ModeDate-based forcing is only available in domain mode.

End-User Notification

Generate end-user notification logic

Script Options

Include basic validation checks

Include comments in generated script

Important: This page now includes a domain policy strategy selector so you can choose whether to use the existing Default Domain Policy path or create a new GPO object.

Note: Effective domain password/account lockout policy still comes from the default domain password policy itself. The “create new GPO object” option adds a separate GPO object for management and optional linking, while the default-only option avoids creating a new GPO object.

Apply Script

Click "Generate Both Scripts" to build your apply script.

Undo / Removal Script

Click "Generate Both Scripts" to build your undo script.