Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the local security policy set to require a minimum password length of 10 characters. On a computer that is not part of a domain, and using the local admin account:

Scenario 1: If a user is created via Control Panel -> Administrative Tools -> Computer Management -> Local Users and Groups with a blank password, the system complains and prevents the account from being created.

Scenario 2: If a user is created via Control Panel -> User Accounts with a blank password, the system allows the account to be created with no problems (with admin rights). You can then log on to the system, with the blank password, but are forced to change it.

Why is the system allowing the account to be created with a blank password in the second scenario? How can it be prevented (policy, registry hack, etc)?


share|improve this question
up vote 1 down vote accepted

I think you can deny access to the User Accounts Applet via GPO or Local Policy. At least in that way you can be sure that the vector you are aware of cannot be taken advantage of.

share|improve this answer
+1. This is probably the way to go, because it fixes the problem, and the only other method of creating user accounts prevents the problem from occurring. Goodness only know why it happens... but if you can stop it from being an issue, don't waste your time trying to figure it out :) – SilentW Aug 30 '10 at 17:14

Are you sure the policy applies? RSOP should allow you to see exactly what is managing the policy and how it applies

share|improve this answer
I am pretty sure that settings are being applied. Try it, on a machine that is not part of a domain, and you'll see it works. I thought that the Resultant Set of Policy only works on a computer that is part of a domain. – Mike Jul 13 '10 at 15:47

I think the policy against blank passwords only applies to users changing their own passwords. One way to ensure that newly created accounts don't fall victim to this would be to look at the password complexity rules and turn these on too.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.