Skip to content
MitoMito Docs

AD-PWDPOL-04: Password complexity should be enabled
ID AD-PWDPOL-04
Severity Medium
Suite Active Directory (on-premises)
Product Active Directory
Feature Password policy
Security area Authentication
Resource type Tenant
User impact of fixing Medium
Effort to fix Low
MITRE ATT&CK T1110
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Password complexity requirements are a fundamental security control that helps prevent weak passwords:

  • Prevents common passwords: Complexity requirements block easily guessable passwords like “password123” or “companyname2024”
  • Increases entropy: Character diversity increases the search space for brute-force attacks
  • Meets compliance requirements: Most security frameworks require password complexity

Complexity alone is not sufficient—length is equally important. The best approach combines both: long passwords (14+ characters) with complexity requirements.

Control Type

Section titled “Control Type”

Preventive

Security Recommendation

Section titled “Security Recommendation”

Enable password complexity requirements to ensure passwords contain characters from at least three of these categories:

  • Uppercase letters (A-Z)
  • Lowercase letters (a-z)
  • Numbers (0-9)
  • Special characters (!@#$%^&*, etc.)

To configure this setting:

  1. Open Group Policy Management
  2. Navigate to the Default Domain Policy
  3. Edit: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy
  4. Enable Password must meet complexity requirements

How the Test Works

Section titled “How the Test Works”

This test retrieves the default domain password policy using Get-ADDefaultDomainPasswordPolicy and checks the ComplexityEnabled property. The test reports:

  • Whether complexity is currently enabled or disabled
  • Recommended setting (Enabled)
  • Whether the configuration meets security best practices
Section titled “Related Tests”
  • Test-MtAdPasswordHistoryCount - Checks password history enforcement
  • Test-MtAdPasswordMaxAge - Checks maximum password age
  • Test-MtAdPasswordMinLength - Checks minimum password length

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.