Skip to main content

How to Set Minimum Password Length Policy in Batch Script

Enforcing a minimum password length is one of the most effective ways to protect user accounts from "Brute Force" and "Dictionary" attacks. By requiring longer passwords, you exponentially increase the time and complexity required to crack a user's credentials. While this is typically managed via Group Policy on a domain, local administrators can easily enforce this rule on standalone workstations using a simple Batch command.

This guide explains how to use the net accounts utility to set and audit your password length requirements.

Why Enforce Minimum Password Length?​

  • Password Strength Enforcement: Ensuring that users don't choose dangerously weak, 1-character, or blank passwords.
  • Compliance Alignment: Meeting the standards for modern security frameworks (e.g., PCI-DSS, which often mandates at least 7 or 8 characters).
  • Security Hardening: Reducing the risk of unauthorized access by making password guessing computationally difficult for attackers.
Desktop vs. Server

This command works on all versions of Windows (Pro, Home, Enterprise, and Server). Note that it only affects Local user accounts, not Domain accounts.

Method 1: Using Net Accounts (The Standard Way)​

The net accounts command is the built-in Windows utility for managing global password and account lockout settings.

@echo off
setlocal

:: Check for admin rights
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] Administrator privileges are required.
    pause
    exit /b 1
)

set "MIN_LEN=10"

echo [PROCESS] Updating Local Security Policy...
echo [INFO] Setting Minimum Password Length to: %MIN_LEN%

:: Apply the new policy
net accounts /minpwlen:%MIN_LEN%

if %errorlevel% equ 0 (
    echo [SUCCESS] Policy updated successfully.
    echo [NOTE] This applies the next time a password is changed,
    echo        not to existing passwords.
) else (
    echo [ERROR] Failed to update. Code: %errorlevel%
    echo [HELP] Value must be between 0 and 14 for net accounts.
)
pause

Method 2: Verifying the Policy Status​

After making a change, it is a best practice to query the system to ensure the new policy is active.

@echo off
echo [PROCESS] Retrieving current account policies...
echo.

net accounts | findstr /i /c:"Minimum password length"

pause

Creating a Security Hardening Script​

A professional script verifies the current setting and only updates it if it is weaker than the required corporate baseline.

@echo off
setlocal

set "BASELINE=12"

echo ============================================================
echo   Account Security Baseline Enforcer
echo ============================================================

:: 1. Verify Admin Rights
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [CRITICAL] Administrator privileges are required.
    pause
    exit /b 1
)

:: 2. Check current setting
set "CURRENT="
for /f "tokens=*" %%a in ('net accounts 2^>nul ^| findstr /i /c:"Minimum password length"') do (
    for %%b in (%%a) do set "CURRENT=%%b"
)

if not defined CURRENT (
    echo [ERROR] Could not determine current password length setting.
    pause
    exit /b 1
)

echo.
echo [STATUS] Current minimum length: %CURRENT%
echo [GOAL]   Required baseline:      %BASELINE%
echo.

:: 3. Apply if needed
if %CURRENT% LSS %BASELINE% (
    echo [ACTION] Increasing password length requirement...
    net accounts /minpwlen:%BASELINE%
    if %errorlevel% equ 0 (
        echo [SUCCESS] Policy updated to %BASELINE% characters.
    ) else (
        echo [ERROR] Failed to update policy. Code: %errorlevel%
    )
) else (
    echo [OK] Your security policy already meets or exceeds the baseline.
)

echo ============================================================
pause

Common Pitfalls and How to Avoid Them​

Administrative Rights​

Users cannot change their own password length requirements. You must run the script (and CMD) as an Administrator.

Character Limit​

Windows generally allows a maximum value of 14 characters for the net accounts command.

Wrong Way:

net accounts /minpwlen:20
:: Result: "An invalid value was entered for the /MINPWLEN option."

Correct Way: If you require longer passwords (e.g., 20+ characters), you must use the Local Security Policy editor (secpol.msc) or use a secedit template import, as the net accounts tool is limited by legacy constraints.

SEO and UX Tip

Advise your users that changing this policy will not force existing users to change their current short passwords immediately. It only applies the next time they (or an administrator) attempt to change the password.

Best Practices for Password Security​

  1. Pair with Expiration: Use net accounts /maxpwage:90 along with your length requirement to ensure passwords are changed periodically.
  2. Lockout Policies: Combine length requirements with a lockout policy (/lockoutthreshold:5) to stop attackers from trying variations of long passwords.
  3. Encourage Passphrases: Advise users to use 3 or 4 random words (e.g., "CorrectHorseBatteryStaple") which satisfy the length requirement but are much easier to remember than "123!@#Abc".
Domain GPO

Note that on a domain-joined machine, the Domain Group Policy will overwrite your local net accounts setting. If your script reports success but the GUI still shows an old value, check for a GPO override.

Conclusion​

Setting and enforcing a minimum password length via Batch script is a fundamental step in building a resilient security perimeter for your Windows machines. By leveraging the net accounts utility, you can automate account hardening and ensure that every user is forced to choose a password that meets your organization's safety standards. This professional approach to security management reduces the risk of successful brute-force attacks and provides a clear, automated mechanism for maintaining a strong and consistent security posture across the entire Windows ecosystem.

Table of Contents