How to Check Password Complexity Requirements in Active Directory

In this tutorial, you will learn how to check if Password Complexity is required in your Active Directory Domain.

What is Password must meet complexity requirements?

If this policy is enabled in your AD Domain it means passwords must meet the following minimum requirements:

Not contain the user’s account name or parts of the user’s full name that exceed two consecutive characters
Be at least six characters in length
Contain characters from three of the following four categories:
- English uppercase characters (A through Z)
- English lowercase characters (a through z)
- Base 10 digits (0 through 9)
- Non-alphabetic characters (for example, !, $, #, %)

How to Check if Password Complexity Requirements are Enabled

There are a few ways you can check if this setting is enabled, the easiest option is to use PowerShell.

Step 1. Open PowerShell and run the following command.

Get-ADDefaultDomainPasswordPolicy

Step 2. Check the value of ComplexityEnabled

This command will return the default password policy for your Active Directory domain. Check the ComplexityEnabled value, if it is True then Password Complexity is enabled for your domain.

check password complexity requirements powershell

The command will also show your other password policy settings. This is a very useful command to quickly get your domain password policy.

Another way to check if password complexity is enabled is to check the Default Domain Policy settings.

Open the group policy management console and edit the Default Domain Policy.

Browse to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy.

Check the policy settings for “Password must meet complexity requirements”. You can see in the screenshot below that complexity is enabled in my domain.