Overview
Windows can enforce a "password must meet complexity requirements" policy. While it can be disabled, doing so weakens account security. This guide explains the policy, shows how to change it, and strongly recommends keeping strong passwords by other means.
Password complexity is a Windows security policy.
Warning: Disabling password complexity reduces account security and makes accounts easier to compromise. Only do this on systems where it is genuinely necessary, and keep a strong passphrase regardless of the policy.
Key Takeaways
- Complexity rules require mixed character types and a minimum length.
- The setting lives in Local Security Policy (secpol.msc).
- Disabling it is possible but not recommended for security.
- Prefer a long passphrase even if complexity is turned off.
What the Complexity Requirement Is
When enabled, the policy blocks passwords that don’t contain a mix of uppercase, lowercase, digits, and symbols, that are too short, or that contain the username. It exists to prevent weak, easily guessed passwords.
Recommended: Keep Strong Passwords
Before disabling the policy, consider that a long passphrase (e.g., four or more random words) is both strong and easy to remember. Keeping complexity on protects every account on the machine. Disable it only if a specific application or test environment requires simpler passwords.
Disable the Policy (If Necessary)
1. Press Windows + R, type secpol.msc, and press Enter (Pro/Enterprise editions).
2. Go to Security Settings > Account Policies > Password Policy.
3. Double-click "Password must meet complexity requirements".
4. Select Disabled and click OK.
5. Run gpupdate /force in an elevated Command Prompt to apply.
Note: Windows Home has no secpol.msc. You can change related settings with the net accounts command, but the complexity toggle is a Pro/Enterprise policy.
Re-enable Complexity
1. Reopen secpol.msc > Password Policy.
2. Set "Password must meet complexity requirements" back to Enabled.
3. Run gpupdate /force to apply.
Troubleshooting
Problem: secpol.msc is missing.
Solution: You’re on Windows Home, which lacks Local Security Policy; the complexity toggle isn’t available there.
Problem: The change didn’t take effect.
Solution: Run gpupdate /force, or sign out and back in; domain policies may override local settings.
Problem: New passwords still rejected.
Solution: A domain Group Policy may enforce complexity centrally — contact your administrator.
Problem: Is it safe to disable?
Solution: Not really. It lowers security; use a strong passphrase and only disable where strictly required.
Conclusion
You can remove Windows’ password complexity requirement through Local Security Policy, but it’s a security trade-off. The safest approach is to keep the policy on — or, if you must disable it, still use a long, unique passphrase for every account.
</w:pBdr><w:spacing w:before="220" w:after="40"/></w:pPr><w:r><w:rPr><w:b/><w:bCs/><w:color w:val="0B5394"/><w:sz w:val="21"/><w:szCs w:val="21"/><w:rFonts w:ascii="Calibri" w:cs="Calibri" w:eastAsia="Calibri" w:hAnsi="Calibri"/></w:rPr><w:t xml:space="preserve">About TechHub
This guide is part of the TechHub Knowledge Base. For more step-by-step IT guides and support, visit techhub.com.lk.
