---
title: "Configure Password Policy for Windows Devices"
slug: "configure-password-policy-for-windows-devices"
description: "Implement robust password policies on Windows devices for enhanced security using Scalefusion's guide."
updated: 2026-06-26T07:25:35Z
published: 2026-06-26T07:25:35Z
canonical: "help.scalefusion.com/configure-password-policy-for-windows-devices"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.scalefusion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Password Policy for Windows Devices

Securing enterprise Windows 10 & above devices is a very important aspect of managing them. A quality password acts as first line of defense in protection against unattended access and stolen/lost devices.

Scalefusion helps you define a password policy, that can be applied to the devices thereby forcing the users to create a password that complies with your organizational policies. In this document, we will walkthrough on how to configure and publish a Password policy which can be implemented both via Modern Management as well as Scalefusion Windows MDM agent.

## Before you Begin

1. Login into Scalefusion Dashboard
2. Have access to one Scalefusion managed Windows 10 & above devices.
3. Supported OS:
  1. Windows 10 & 11: Pro, Enterprise, Education, Business
  2. Windows Server OS: 2019 (Tested), 2022 & above
  3. Windows IoT Enterprise: LTSC / LTSB versions
4. Choose a **Password Policy Method** which will be applied on devices. To do so,
  1. Navigate to **Utilities → Global Settings → Windows Settings**
  2. Choose Password Policy Method from the drop-down and click **Save Settings**:
    1. **Modern Management:** Works only if device is modern managed
    2. **Scalefusion MDM Agent:** Works only if Scalefusion MDM agent **v16.13.0** or above is installed on devices

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-IDU35ND6.png)

Password Policy does not apply to Entra (Azure) AD (domain joined) enrolled devices.

## Creating a Password Policy

Password policy can be created in two ways:

1. [Global Level](/v1/docs/configure-password-policy-for-windows-devices#configure-password-policy-at-the-profile-level1)
2. [Profile Level](/v1/docs/configure-password-policy-for-windows-devices#configure-password-policy-at-the-profile-level)

## Configure Password Policy at the Global Level

1. Navigate to **Device Profiles & Policies > Passcode Policy > Windows** section.
2. Toggle on the **Require Passcode** setting.

> [!NOTE]
> - Settings marked with windows icon are supported through **Modern Management**, while settings marked with Scalefusion icon are supported through the **Scalefusion MDM Agent**.
> - Settings marked with ***** are supported by **Modern Management** on the following Windows versions:
>   - Windows 11 22H2 with KB5053657 (OS Build 22621.5126) or later
>   - Windows 11 24H2 (OS Build 26100) or later.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-FNHPLXMT.png)
3. Following are the options available for Password Policy settings and their applicability to **Agent-based management** and **Modern Management**.

### Basic Settings

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-6Q6RG9C3.png)

| Setting | Description | Applies To | Additional Notes |
| --- | --- | --- | --- |
| **Select Password Type** | Select the password type to be enforced on managed devices. | Modern Management | Available only for Modern Management policies. |
| [**Minimum Password Length**](/v1/docs/configure-password-policy-for-windows-devices#password-length-mapping) | Specify the minimum number of characters required for a password. | Agent, Modern Management | [**Allowed Range:**](/v1/docs/configure-password-policy-for-windows-devices#password-length-mapping) • **Modern Management:** 6–16 characters • **Agent:** 0–14 characters |
| **Enable Complex Password*** | Enforces password complexity requirements. | Agent, Modern Management | When enabled, the minimum password length must be **6 characters or greater**. |

#### Minimum Password Length Mapping (switching methods)

In case Admin switches from Agent method to Modern Management Method or vice versa in Global Utilities, the following value mapping is applied automatically as the minimum password length:

| Agent Value | Modern Management Value |
| --- | --- |
| 0–5 | 6 |
| 6–14 | Retains the same value (6-14) |

| Modern Management Value | Agent Value |
| --- | --- |
| 15–16 | 14 |
| 6–14 | Retains the same value |

### Password Management Settings

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-CV5X1Q1X.png)

| Setting | Description | Applies To | Additional Notes |
| --- | --- | --- | --- |
| **Select Password Expiry Period** | Defines how long a password remains valid before expiration. | Modern Management | It is mandatory to select expiry period and it can be from 1 to 42 days. |
| **Maximum Password History List** | Specify the number of previously used passwords that cannot be reused. | Agent, Modern Management | Helps prevent password reuse. **Range:** 1 to 24 |
| **Minimum Password Age** | Specify the minimum number of days a password must be used before it can be changed. | Agent | **Range:** 0–998 days **Default:** 1 day |
| **Maximum Password Age** | Specify the maximum number of days a password can be used before a password change is required. | Agent | **Range:** 0–999 days **Default:** 42 days > [!NOTE] > Minimum Password Age must be less than the configured Maximum Password Age. |
| **Interactive Logon: Prompt User to Change Password (Days Before Expiry)** | Specify how many days before password expiration users are prompted to change their password. | Agent | **Range:** 0–998 days **Default:** 5 days |
| **Limit Local Account Use of Blank Passwords to Console Logon Only** | Enabling this restricts local accounts with blank passwords from being used for remote sign-ins. | Agent | **Default:** ON |

### Advanced Settings

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-URICSEGN.png)

| Setting | Description | Applies To | Additional Notes |
| --- | --- | --- | --- |
| **Choose Complexity Type** | Select the password complexity standard to apply. | Modern Management | It can be Digits & Lowercase letters |
| **Configure Max Attempts to Enforce BitLocker Recovery Mode / Restart** | Specify the number of failed password attempts before BitLocker Recovery Mode or a device restart is enforced. | Modern Management | By default it is set to Never. Range: 4-999 |
| **Set Idle Time for Auto-Lock** | Specify the period of inactivity after which the device automatically locks. | Agent, Modern Management | **Range:** 1-999 minutes > [!WARNING] > If it is agent mode, device restart is required |
| **Configure Maximum Number of Failed Logon Attempts That Causes a User Account to Be Locked Out*** | Specify the number of failed sign-in attempts allowed before the account is locked. | Agent, Modern Management | **Range:** 1–999 attempts **Default:** Never > [!CAUTION] > Locked user accounts can be manually unlocked from the [**User Accounts**](/docs/add-and-manage-users-at-device-level#actions-on-users) section of the device details page, subject to [few conditions](/docs/configure-password-policy-for-windows-devices#a-user-has-been-locked-out-after-too-many-failed-login-attempts-why-isnt-it-showing-on-my-dashboard-yet) ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-VYXSM4GY.png) |
| **Configure the Duration After Which a Locked-Out Account Is Automatically Unlocked*** | Specify how long a locked account remains locked before it is automatically unlocked. | Agent, Modern Management | **Range:** 1–99,999 minutes **Default:** Never Unlock > [!WARNING] > This setting is available only when a value has been configured for **Failed Logon Attempts**. |

###
4. Once you have configured the desired policy, click **Save Policy.**

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-Z6P70PEP.png)

## Publishing a Password Policy

1. Once you have created a password policy, you can publish it to the Device Profiles. To do so, navigate to **Device Profiles & Policies > Passcode Policy**. Under Windows tab, click on **Apply to Device**.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-TJFQJS8U.png)
2. Select the Device Profile(s) where you want to apply the policy to and click on **Submit**.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-CFWMCI0L.png)
3. Once the policy is applied and the devices sync with the Scalefusion dashboard, they will be forced to change the password the next time the device reboots or they Login to their account on device.

It is observed that irrespective of the current password on the device, users are forced to create a new password.

## Removing a Password Policy

1. If you want to relax the password policy and want to remove a password policy from devices, then navigate to **Device Profiles & Policies > Passcode Policy** and click on **Delete** icon.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-P0J7NO3N.png)
2. Select the Device Profile(s) where you want to remove the policy from and click SUBMIT.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image%20-%202023-09-05T161608.397.png)
3. Once you remove a password policy from a device profile, following are the actions taken,
  1. All the future devices that enroll into the device profile will not be enforced to create a password.
  2. For the current devices in the profile, however, the password that is already configured is not removed.

## Configure Password Policy at the Profile Level

1. On the Scalefusion Dashboard, navigate to **Device Profiles & Policies > Advanced Configurations** and click **Create Configuration**.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-029R071B.png)
2. Under the **Windows** tab, select **Profile Level Password Policy**.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1SCYNFTB.png)
3. Configure the required password policy settings. These settings are similar to those available under the [Global Password Policy configuration](/v1/docs/configure-password-policy-for-windows-devices#configure-password-policy-at-the-profile-level1).
4. Click **Save Policy**.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-7K6S0CNL.png)

> [!WARNING]
> Profile-level password policies override the password policy configured at the Global level.
5. The **Publish** dialog appears automatically.
6. Select the device profiles to which you want to apply the policy.
7. Click **Publish** to deploy the configuration.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-IOC8AMV3.png)
8. If you do not want to publish the configuration immediately, you can close the **Publish** dialog. The configuration will still be saved and listed under **Advanced Configurations**.
9. Here, click the **three-dot menu** under the **Actions** column to perform the following actions:

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-RUZ9KX6I.png)
  - **Edit:** Modify the configuration settings.
  - **Publish:** Assign the configuration to one or more device profiles.
  - **Unpublish**: Remove the configuration from previously assigned device profiles.
  - **Delete**: Permanently remove the configuration.

---

### FAQs

#### What happens if a local user account was created before the password policy was deployed?

If an administrator created a local user account through **Windows Settings → Accounts → Other Users** before the password policy was deployed, Windows sets that account's **Password Never Expires** option to **on** by default. This means the account would not be subject to password expiration, even after the policy is applied, until the agent corrects it.

Once the password policy is published, the agent automatically detects accounts with Password Never Expires turned on and disables that setting. The agent checks **every 30 minutes** and will enforce the correct configuration, no manual action is needed.

> [!NOTE]
> There may be up to a 30-minute delay before the correction is applied to any affected account.

#### Does this 30-minute check apply to all local user accounts?

No. The 30-minute remediation loop only applies to accounts created directly through the Windows Settings app. Accounts created through **Scalefusion User Account Management (UAM)** or the native **Windows Local Users and Groups** tool *(lusrmgr.msc)* do not have Password Never Expires turned on by default, so no remediation is needed for those accounts.

#### A user has been locked out after too many failed login attempts. Why isn't it showing on my dashboard yet?

When a user account is locked out, the dashboard does not reflect this instantly. There is a short synchronisation delay before the Locked status and the Unlock Account button appear in the User Account Management (UAM) section. This is expected behaviour and does not indicate a problem.

The dashboard will update as soon as any one of the following occurs on the affected device:

1. An administrator or another user signs into a different account on the same device.
2. The device is restarted.
3. The agent's regular sync interval completes (typically every 15 minutes).

#### Why are users being asked to change their password right after the password policy is first deployed?

This is expected behaviour. When a password policy is deployed to a device for the first time, the agent automatically prompts all targeted local user accounts to change their password at next login. This ensures every account immediately complies with the new policy from day one, rather than waiting for each user's existing password to naturally expire.

#### Which accounts are affected by this forced password change?

It depends on the policy type being deployed:

- **Agent-driven policy:** All targeted local accounts are prompted to change their password, **except** the *Global Admin account (if enabled from the dashboard)*.
- **Modern Management password policy:** All targeted local accounts are prompted to change their password, **including** the *Global Admin account*.

> [!WARNING]
> This one-time prompt only occurs on initial deployment. Subsequent policy updates do not trigger a forced password change.

#### What happens if Scalefusion password policies are applied to devices that are also managed by Active Directory Group Policy?

When a device is joined to a Windows Server domain and receiving password settings via Active Directory Group Policy, both systems will compete to apply their own configuration. This creates an unstable loop where settings on the device are never consistent.

How the conflict happens?

1. Active Directory applies its password settings, either on a scheduled Group Policy refresh or when a manual update is triggered.
2. The Scalefusion agent detects the change and overwrites the settings with its own policy configuration.
3. The next Group Policy refresh restores Active Directory's settings and the cycle repeats indefinitely.

This back-and-forth makes it impossible to determine which policy is actually in effect at any given time and can lead to unpredictable behaviour for end users.

**Recommended approach**

Always manage password policies from a single source. Choose one and use it exclusively:

- **Option A:** Manage all password policies through Active Directory Group Policy and do not deploy password policies via Scalefusion.
- **Option B:** Manage all password policies through Scalefusion and remove conflicting password rules from your Active Directory Group Policy.

> [!WARNING]
> This also applies when using Modern Management alongside domain-based policies as mixing the two produces the same conflict. Always use one source of truth.

#### What happens if multiple password or security policies are applied to the same device?

When more than one password or security policy applies to a device, the system automatically resolves any conflicts based on a predefined policy precedence order. Policy precedence is applied automatically to ensure consistent enforcement when multiple security configurations target the same device. The following rules are used:

| Policy Combination | Result |
| --- | --- |
| **Veltar Compliance** and **Agent-Driven Password Policy** | **Veltar Compliance** takes precedence and overrides the Agent-Driven Password Policy settings. |
| **LAPS** and **Agent-Driven Password Policy** | The system enforces the **more restrictive (stricter) setting** for each password requirement. For example, a higher minimum password length or a shorter password rotation period will be applied. |
| **Veltar Compliance**, **LAPS**, and **Agent-Driven Password Policy** | **Veltar Compliance** has the highest priority and overrides settings from both LAPS and Agent-Driven Password Policy. |

#### How does the Idle Time for Auto-Lock setting work, and what happens if Windows Power Settings are also configured?

The **Idle Time for Auto-Lock** setting allows you to define how long a device can remain inactive before it is automatically locked. The supported range is 1–999 minutes. After this setting is applied, a device restart is required for the policy to take effect.

When both the Idle Time for Auto-Lock policy and Windows Power Settings are configured, the following behavior applies:

- **Scenario 1: Windows Power Settings are set to "Never"**

If the device's local Windows Power Settings (such as screen timeout or sleep settings) are configured to **Never**, the configured **Idle Time for Auto-Lock** policy is enforced and determines when the device locks after inactivity.
- **Scenario 2: Both settings specify a time value**

If both the Windows Power Settings and the Idle Time for Auto-Lock policy are configured with specific time intervals, the device will enforce the **shorter (more restrictive) timeout value**.

**Examples:**

- **Windows Power Settings:** 10 minutes **Idle Time for Auto-Lock:** 5 minutes **Result:** The device locks after **5 minutes** of inactivity.
- **Windows Power Settings:** 3 minutes **Idle Time for Auto-Lock:** 10 minutes **Result:** The device locks after **3 minutes** of inactivity.