- If you wanted to script this action on non-domain joined PCs the command is:
net accounts /minpwlen:15
- Group Policy location
Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy
- Registry location
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Network
Value Name: MinPwdLen
Data Type: REG_BINARY (Binary Value)
- If your domain is 2012 or above you can now configure a longer password using “Fined Grained Password Policies” or Password Setting Object (PSO)
NOTE: XP\2003 have been out of support for a long time. Strong passwords can't protect you. There is an RCE called "Eternal Blue" in SMB that makes passwords for these old systesm obsolete. Anyone can log in remotely without a password now.
DETAIL: https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2017/ms17-010
PSOs in Windows 2012+
Setting up PSO’s within Windows 2012+ is easy and won’t affect users until they attempt their next password change.
Control Panel -> System and Security -> Administrative Tools -> Advice
Directory Administrative Center
DomainName -> System -> Password Settings Container
Right Click -> New -> Password Settings
Complete the PSO settings and assign a User or User Group target. To assign the policy to all users, use “Domain Users”. Notice in this test we have specified 20 characters to be the minimum length for acceptable passwords.
SOURCE:
https://www.blackhillsinfosec.com/increase-minimum-character-password-length-15-policies-active-directory/