Relution Signet Customer Hub

Password

The Password policy configuration defines the requirements a device password has to meet on managed Windows devices, and how the device behaves on inactivity or failed sign-in attempts.

Configuration options

  • Password enabled — Specifies whether device lock is enabled.
  • Passcode Quality — This setting specifies whether a passcode should be numeric (e.g. “1042”), alphanumeric (e.g. “A42B”), or free to choose.
  • Allow simple passwords — Specifies whether PINs or passwords such as “1111” or “1234” are allowed.
  • Minimum passcode length
  • Idle time before display is locked — Specifies the amount of time (in minutes) that the computer can remain idle before it is password locked. Default value is 0 - Device does not lock.
  • Maximum passcode age (in days) — Number of days until the password expires. Default value is 0 - Passwords do not expire.
  • Minimum passcode age (in days) — Determines the period of time (in days) that a password must be used before the user can change it. Default value is 0 - Allow changes immediately.
  • Passcode history — Default value is 0 - Current password could be changed to any password (even the same password). With a setting of 1 the user cannot reuse their current password when choosing a new password, while a setting of 5 means that a user cannot set their new password to their current password or any of their previous four passwords.
  • Number of failed passcode attempts before all data is erased — Number of authentication failures allowed before the device will be wiped. Default value is 0 - Disables a device wipe functionality. On a device, when the user reaches the value set by this policy, it is not wiped. Instead, the device is put on BitLocker recovery mode, which makes the data inaccessible but recoverable. If BitLocker is not enabled, then the policy cannot be enforced.

Minimum quality

Three values are available for the minimum quality:

  • Numeric
  • Alphanumeric
  • User choice