How to Use the macOS pwpolicy Command to Enforce Password Rules

When deploying fleets of Mac computers in an enterprise environment, administrators must ensure that local user accounts comply with strict corporate security policies. A standard macOS installation allows users to set incredibly weak passwords, such as \”password123\” or even blank strings. While mobile device management (MDM) profiles are the modern standard for enforcing these rules at scale, systems administrators often need to script, query, or manually enforce local password complexity on individual machines without a server. To mathematically govern exactly what constitutes a valid user password, macOS administrators use the pwpolicy command.

Why Use the pwpolicy Command?

The pwpolicy (password policy) command provides direct access to the underlying OpenDirectory authorization infrastructure. Instead of relying on GUI checklists, pwpolicy allows you to define complex, highly granular rules using Extensible Markup Language (XML) property lists (plists). You can dictate the exact number of required uppercase letters, numbers, and special symbols. Furthermore, you can enforce password expiration timelines, prevent users from recycling previous passwords (history limits), and lock accounts after a specific number of failed login attempts. It is the definitive gatekeeper for local credential security.

Step 1: Check Current Global Policies

Before implementing new rules, you should audit the current state of the machine. Because pwpolicy manipulates core authentication databases, it generally requires root privileges.

1. Open the macOS Terminal.
2. Run the command to query the global policy:

sudo pwpolicy -getglobalpolicy

If the output states Global policy: followed by nothing, or returns an error, it means the machine is currently using the default, unrestricted Apple behavior.

Step 2: Create a Password Policy File

To set a policy, you must first construct a plain-text XML file containing your mathematical rules.

1. Create a file on your desktop named policy.plist.
2. Inside the file, define your rules using standard macOS dictionary keys. For example, to require a minimum of 12 characters, including at least 1 number and 1 uppercase letter, the syntax involves keys like policyCategoryPasswordContent and a complex string of policyAttribute parameters.
3. (Note: Due to the complexity of Apple’s proprietary XML schema for OpenDirectory, administrators highly recommend using a syntax generator or referencing Apple’s official Developer Documentation for the exact boilerplate XML required for your specific ruleset).

Step 3: Apply the Global Policy

Once your XML file is flawlessly formatted, you must inject it into the authorization database.

1. In the Terminal, use the -setglobalpolicy flag, directing the command to read from your newly created file:

sudo pwpolicy -setglobalpolicy < ~/Desktop/policy.plist

The command will silently parse the XML and apply the rules. From this moment on, if any user on the system attempts to change their password via System Settings, the operating system will mathematically evaluate their input against your rules and reject any weak strings.

Step 4: Target Specific Users

You can also bypass the global system and apply rules directly to individual accounts.

1. To query the policy of a specific user account (e.g., \”jdoe\”):

sudo pwpolicy -u jdoe -getpolicy

1. To clear all custom policies and revert a specific user back to the default macOS behavior:

sudo pwpolicy -u jdoe -clearaccountpolicies

By mastering the pwpolicy command, systems administrators can guarantee that every local macOS account maintains cryptographic hygiene that aligns with enterprise security frameworks.