macOS Password Policy

[popo31477]

Hello everyone. I'm new to the forum.

I am wanting to know how to edit the password policy (minimum length, age, complexity requirement, ect). I know this can be accomplished in terminal but I need to know if there's another method, perhaps for users who are non-technical.

I would appreciate any help. Thank you!

 

[Raz0rEdge]

On your local machine, there shouldn't be any specific policy in place. If your Mac is a managed one, then the manager might have policies in place that you cannot change.

My work MBP is a managed machine and I have to change the password every 90 days and can't repeat the passwords for 3 changes and it has to be relatively complex and all that.

 

[IWT]

Hello everyone. I'm new to the forum.

I am wanting to know how to edit the password policy (minimum length, age, complexity requirement, ect). I know this can be accomplished in terminal but I need to know if there's another method, perhaps for users who are non-technical.

I would appreciate any help. Thank you!

A warm welcome to Mac-Forums.

If you are talking about the Admin Password for Log In and accepting changes and new apps etc -

Open System Preferences > Users & Groups > Make Sure "Password" is selected rather than "Login Items".

You will see there "Change Password" if one has already set one up. Click on that. There are no special characters required. Any word of any length or character will be accepted from"dog" to a 16 character complex PW. Your choice.

But, as already stated, if the Mac is "owned" by an employer or other, then you may not be able to change it.

Is this what you were asking about??

Ian

 

[popo31477]

Hey guys. Thank you for your responses. So I am in the IT Security team for my company. Our customers own their own personal computers, mostly Windows of course. Some have Macs. In Windows, to edit the security policy you simply open "SecPol.msc" which allows you to edit the password parameters required for each user profile on the machine. On a Mac, the only way I know how to do this is via terminal, via a command similar to this:

pwpolicy -a username -u username -setpolicy "minChars=8 requiresAlpha=1".....so forth.

I am wanting to see if there is a way to set the password policy on a mac without using the terminal. There must be a way, but it's incredibly hard to find online anywhere.

 

[IWT]

Thank you for that. I misunderstood your question. Apologies.

Ian

 

[Raz0rEdge]

Thanks for the additional context, it always helps to provide all that info upfront.

The bulk of us are end users of Mac and as such that's the context we use to answer questions.

Some searches yield ways of adding Macs to an existing Active Directory or using MDM profiles to manage the Macs. We don't know enough about your IT infrastructure to tell you what would work here.

However, if you do have a Terminal command to get your task accomplished, while it might not be a UI, and it's a one time action, you have a way of documenting the command and performing the action once on each Mac you wish to use.

 

[popo31477]

Thank you. Our user base is not part of AD. Just assume that our users simply purchased their own Mac themselves brand new, stock settings. How would one go about editing the password policy other than using terminal? Isn't there a normal settings area for this, similar to Windows secpol.msc?

 

[Raz0rEdge]

The BYOD space is really like the wild west right now. I'm in a similar situation since I have a company provided MBP and my own Mac Mini. The mini is where I do all of my work and MBP is where I do after work emailing and reading..

The MBP is managed through MS InTune and is locked down hard and has Sophos (UGH!) on there.

My Mac Mini is managed by me and doesn't have any of that stuff on there.

But to answer your question directly, no there is no UI to manage the policy.

 

[popo31477]

OK thank you all for the help.

 

[popo31477]

I do have another question related to this. Editing the password policy via terminal is just for the physical machine correct? If a user has their iCloud account associated with their mac, and the password policy is changed via terminal, it doesn't change the password policy for their iCloud password, just the local machine password, is that right?

 

[Raz0rEdge]

That is correct. iCloud has its own set of requirements.