Skip to main content

Secureframe Agent: Password Policy Check

Written by Brady Price

Password policy requirements

The Secureframe Agent password policy check verifies that a device enforces a minimum password length and complexity requirements. Results update after the agent syncs with Secureframe, typically within a few hours of changing local device settings.

To pass this check, the device must enforce:

  • Minimum password length: 8 characters or more

  • Password complexity: Enabled, or an equivalent policy that requires multiple character types

Use the steps below to set the requirement on Windows, Mac, or Linux, then verify the setting locally before waiting for the Agent to sync.

Set password policy by operating system

Choose the instructions for the operating system on the device that is failing the password policy check.

Windows

Windows 10/11 Pro includes the tools needed to set a local password policy. Windows 10/11 Home does not include these tools by default, so use the Windows Home steps below or enforce the requirement through an MDM.

Option 1: Group Policy Editor

  1. Open the Run program and enter gpedit.msc.

  2. Go to Computer Configuration → Windows Settings → Security Settings → Account Policies → Password Policy.

  3. Set Minimum password length to 8.

  4. Set Password must meet complexity requirements to Enabled.

Option 2: Local Security Policy

  1. Open the Run program and enter secpol.msc.

  2. Go to Security Settings → Account Policies → Password Policy.

  3. Set Minimum password length to 8.

  4. Set Password must meet complexity requirements to Enabled.

Windows 10/11 Home

  1. Download the batch script to install gpedit.msc.

  2. Right-click the file and select Run as administrator.

  3. Wait up to 10 minutes for the script to install Group Policy Editor.

  4. Follow the Group Policy Editor steps above.

Note: If Google Drive shows “Can’t scan this file for viruses,” click Download anyway. This is expected because the file is executable. If the link asks you to request access or does not open, try a private/incognito window, switch off a personal Google account, use a different network, or email [email protected] and we can send the file directly.

Note: Windows Hello, PIN, or biometric sign-in does not replace the password policy values this check reads. The device still needs password length and complexity policy configured, or the requirement must be enforced through an MDM.

If it is too time-consuming to configure every Windows device manually, use an MDM to enforce these settings. See Supported MDMs and Their Endpoint Security Capabilities.

Mac

On macOS, the password policy is enforced through a configuration profile or an MDM. The profile must include requireAlphanumeric set to true and minLength set to at least 8.

  • An MDM such as Kolide or Jamf Pro can create and enforce a password and screen lock policy.

  • If you are not using an MDM, install Secureframe’s pre-built macOS profile. This profile also enforces the required screen lock settings.

  • To install the profile, open the downloaded file. System Settings should open to Device Management, where you can review and install the profile.

Note: On macOS 15 and newer, profiles are managed under System Settings → Privacy & Security → Device Management. On older macOS versions, this may appear as Profiles.

Resources for building your own profile:

Linux

The Linux password policy check will not pass until you have both updated the password requirements and changed the local password so it complies with those requirements.

Requirements:

  • Minimum password length of at least 8 characters

  • At least 3 character classes across digits, uppercase letters, lowercase letters, and special characters

  1. Install the augeas-lenses library and PAM password quality module.

  2. For Ubuntu/Debian-based systems, run sudo apt install augeas-lenses and sudo apt install libpam-pwquality. For other distributions, install the equivalent pam_pwquality / libpwquality packages.

  3. Open /etc/pam.d/common-password.

  4. Find the line that includes pam_pwquality.so.

  5. Add minlen=8 minclass=3 to the end of that line. Example: password requisite pam_pwquality.so retry=3 minlen=8 minclass=3

  6. Run passwd and set a new password that meets the requirements.

If your Linux device is not checking in after restarting, see Secureframe Agent: Linux device check in after restarting.

Verify it worked

After applying settings, confirm the policy is in place on the device before waiting for Secureframe Agent data to update.

Windows

  1. Open the Run program and enter secpol.msc.

  2. Go to Security Settings → Account Policies → Password Policy.

  3. Confirm Minimum password length is 8 and Password must meet complexity requirements is Enabled.

You can also open Command Prompt and run gpresult /r. Review the Computer Settings section for password policy values applied to the device.

Mac

  1. Open System Settings → Privacy & Security → Device Management (or Profiles on older macOS versions).

  2. Confirm the Secureframe password and screen lock profile is listed and installed.

  3. If you created your own profile, confirm it includes requireAlphanumeric set to true and minLength of at least 8.

Linux

  1. Open /etc/pam.d/common-password and confirm the pam_pwquality.so line includes minlen=8 minclass=3.

  2. Confirm the local password has been changed after the PAM update. The check will not pass until the configuration is updated and the password complies.

Still failing?

If the local setting looks correct but Secureframe still shows the password policy check as failing, work through these checks.

Allow time for Agent sync

  • Keep the device online for at least 5 minutes after changing settings.

  • Agent results can take a few hours to appear in Secureframe after the device checks in.

  • An admin can manually sync the Secureframe Agent integration from Integrations → Secureframe Agent if needed.

Reinstall with a fresh Agent package

Devices enrolled with an outdated Secureframe Agent package may not report password policy data correctly and may never pass this check, even after settings are updated.

Important: Fully uninstall the existing Secureframe Agent before installing a new package. Installing over an old version can prevent the check from updating.

  1. Uninstall Secureframe Agent. See Secureframe Agent: Unenrolling & Uninstall Secureframe Agent.

  2. Log into Secureframe and download a fresh agent package from Employee Onboarding.

  3. Install the new package and wait for the device to sync.

Windows Home or personal devices

  • Windows Home can be harder to verify because Group Policy Editor and Local Security Policy are not native to the edition.

  • If the script workaround fails or your organization cannot manage the device, consider upgrading to Windows Pro, enforcing the setting through an MDM, or uploading manual evidence for the password policy test.

  • If you upload manual evidence, use the test’s Pass with Upload flow. Adding files as Additional Evidence alone will not pass the test.

Mac profile installed but fields still show missing

  • Confirm the profile is installed in Device Management, not only downloaded.

  • Confirm the Agent has synced after profile installation.

  • If password policy, screen lock, and firewall all show missing, verify the Agent is running and ask an admin to manually sync the Secureframe Agent integration.

For more endpoint-check scenarios, see FAQs: Secureframe Agent: macOS profiles, password policy, and endpoint checks.

Troubleshooting

Windows Home script errors: 0x8007371b / DISM Error 14107

When running InstallGroupPolicyEditor.bat on Windows Home, you may see Error: 14107 0x8007371b - One or more required members of the transaction are not present.

  1. Confirm Windows edition: Press Windows + R, run winver, or go to Settings → System → About and check Windows specifications.

  2. Temporarily disable antivirus interference: Some antivirus tools may block executable scripts. Re-enable antivirus after testing.

  3. Repair Windows system files: Open Command Prompt as administrator and run sfc /scannow, then DISM /Online /Cleanup-Image /RestoreHealth.

  4. Install pending Windows updates: Go to Settings → Windows Update, install updates, restart, and retry.

  5. Collect logs for support: Include C:\Windows\Logs\DISM\dism.log, Secureframe Agent logs, device name, OS edition, and whether the device is managed by an MDM.

If the problem continues, contact [email protected] with your logs and system details.

Related articles

Related Articles
Did this answer your question?