How to Use the net accounts Command in Windows 11 to Configure Password Age and Account Lockout Policies

Securing local user accounts on Windows 11 workstations is essential for preventing brute-force password guessing and credential compromise. While domain-joined enterprise machines enforce security baselines via Active Directory Group Policy (GPO), standalone workstations or local admin accounts often operate without password expiration limits or lockout thresholds by default. Windows 11 includes net accounts, a command-line tool within the classic Net Services suite. Using net accounts, administrators can query and enforce password length, expiration aging, account lockout thresholds, and lockout reset timers without opening the Local Security Policy GUI.

Launching Elevated Administrative Terminal Console

Modifying local account security policies alters protected security database parameters (SAM). Launch the command line with administrative permissions:

1. Press Win + X and choose Terminal (Admin) or PowerShell (Admin).
2. Confirm the User Account Control (UAC) prompt to open an administrative console.

Querying Current Account and Password Policies

To inspect your current password rules and lockout baselines, run the command without parameters:

net accounts

The terminal outputs a summary of your local security configuration:

Force user logoff how long after time expires?:       Never
Minimum password age (days):                          0
Maximum password age (days):                          42
Minimum password length:                              8
Length of password history maintained:                5
Lockout threshold:                                    Never
Lockout duration (minutes):                           30
Lockout observation window (minutes):                 30
Computer role:                                        WORKSTATION

Enforcing Minimum Password Length

Short passwords can be cracked in seconds using automated rainbow tables. To require that all local accounts maintain a password of at least 12 characters:

net accounts /minpwlen:12

Values can range from 0 to 14 characters. Any user attempting to set a password shorter than the specified length will receive a policy rejection error.

Configuring Password Aging (Minimum and Maximum Age)

Password aging policies prevent users from keeping compromised passwords indefinitely and prevent immediate password recycling:

• /maxpwage: Sets the maximum number of days a password remains valid before Windows forces the user to change it. Setting to UNLIMITED disables expiration.
• /minpwage: Sets the minimum number of days that must elapse before a user is allowed to change their password again, preventing users from rapidly rotating passwords to bypass history rules.

To require password updates every 90 days, while requiring at least 1 day between password changes:

net accounts /maxpwage:90
net accounts /minpwage:1

Enforcing Password History to Prevent Recycling

To prevent users from toggling back and forth between their favorite two passwords, enforce password uniqueness by retaining history:

net accounts /uniquepw:5

Windows records the last 5 password hashes in the Security Account Manager (SAM) and blocks users from reusing any recent password.

Configuring Account Lockout Protection Against Brute-Force Attacks

By default, Windows standalone workstations set the lockout threshold to Never, leaving login screens vulnerable to continuous PIN or password dictionary guessing. To configure robust lockout protection, configure three coordinated parameters:

1. Lockout Threshold (/lockoutthreshold): Number of consecutive failed password attempts permitted before locking the account (e.g., 5 attempts):

   net accounts /lockoutthreshold:5

2. Lockout Duration (/lockoutduration): Duration in minutes the account remains locked before unlocking automatically (e.g., 30 minutes):

   net accounts /lockoutduration:30

3. Lockout Observation Window (/lockoutwindow): Time in minutes between failed attempts before the failure counter resets back to zero (must be less than or equal to the lockout duration):

   net accounts /lockoutwindow:30

Targeting Active Directory Domain Accounts

If your machine is connected to an enterprise corporate domain, appending the /domain switch queries and applies account policy parameters directly against the Active Directory domain controllers:

net accounts /domain

Net Accounts Parameter Reference Table

Parameter Switch	Security Function
net accounts	Displays full summary of active account and password policies.
/minpwlen:[N]	Sets minimum required password length (0 to 14 characters).
/maxpwage:[Days]	Sets maximum password age before forced expiration (or UNLIMITED).
/minpwage:[Days]	Sets minimum days before user can change password again.
/uniquepw:[N]	Maintains history of last N passwords to block recycling.
/lockoutthreshold:[N]	Permitted consecutive failed logins before locking account.
/lockoutduration:[Mins]	Number of minutes an account stays locked.
/lockoutwindow:[Mins]	Observation time window before resetting failed attempt tally.