Master Windows Password Policies and Account Management with PowerShell

Overview

Managing user accounts and password policies is a critical step for securing Windows environments. This guide explains how to use built‑in Windows tools and PowerShell to view, set, export, and import password policies, check user status, and unlock accounts.

Viewing and Setting Password Policies

Windows supports local and domain password policies to enforce password length, complexity, and change intervals.

Local password policy : Use secpol.msc to view and configure policies on the local machine.

Domain password policy : In a domain, use the Group Policy Management Console gpmc.msc to set policies that apply to all domain users.

Fine‑grained password policies (FGPP) allow different policies for specific users or groups and can be managed via the Active Directory PowerShell module using Get-ADFineGrainedPasswordPolicy and New-ADFineGrainedPasswordPolicy cmdlets.

Exporting and Importing Security Policies

The secedit.exe tool can export and import security configurations, helping synchronize settings across multiple systems.

Export policy : secedit /export /cfg C:\security-policy.inf Import policy :

secedit /configure /db secedit.sdb /cfg C:\security-policy.inf /overwrite

Checking Local User Status

PowerShell’s Get-LocalUser cmdlet provides details about local accounts, including whether they are enabled or expired. The following command outputs the information in JSON format for easy reporting.

Get-LocalUser | ConvertTo-Json

Unlocking and Managing User Accounts

Accounts may become locked after multiple failed logins. The script below checks a specific account’s lockout status and unlocks it if necessary.

$User = Get-LocalUser -Name "username"
if ($User.AccountLockoutTime -ne $null) {
    Unlock-LocalUser -Name "username"
}

Conclusion

By applying these methods, Windows administrators can effectively enforce password standards, synchronize security settings, and monitor account health, thereby improving overall system security and operational efficiency. It is recommended to test these procedures in production environments before wide deployment.