How to Remove Password Complexity in Windows Server 2025

Learn how to disable password complexity in Windows Server 2025 using Group Policy, Local Security Policy, and PowerShell, with step-by-step instructions and security considerations.

What Does Password Complexity Mean in Windows Server 2025?

Windows Server includes a built-in password complexity policy that controls the composition of passwords when users create or change them. When the policy is enabled, Microsoft documents requirements that include using characters from at least three of four categories: uppercase letters, lowercase letters, numerals, and special characters. The password also cannot contain the user’s account name or certain parts of the user’s full name. citeturn0search1turn0search7

The setting is named Password must meet complexity requirements. It is found under the Password Policy section of Windows security policy. Complexity is checked when a password is created or changed; it is not a command that automatically rewrites existing passwords. citeturn0search7

When Would an Administrator Remove Password Complexity?

Removing complexity is normally an exception rather than a security baseline. A controlled lab, isolated development environment, legacy application test, migration exercise, or other documented compatibility requirement may justify changing the setting temporarily.

For production infrastructure, first determine whether the requirement can be solved another way. A targeted policy, longer passphrase, managed account, or stronger authentication method may avoid weakening password requirements for unrelated users.

Prerequisites and Planning

Before changing the setting, identify exactly which policy controls the account. This is particularly important in Active Directory because changing local policy on a member server does not automatically change the domain password policy.

1. Confirm you have the required administrative permissions.
2. Determine whether you are changing a local account or a domain account.
3. Determine whether the server is standalone, domain joined, or a domain controller.
4. Record the current password policy before making the change.
5. Use a test account before changing production credentials.
6. If a GPO is involved, document the GPO and have a rollback plan.

Method 1: Disable Password Complexity with Local Security Policy

For a standalone Windows Server 2025 system where the requirement applies to local accounts, Local Security Policy provides the clearest graphical procedure.

Step 1: Open Local Security Policy

Press Windows + R, enter the following command, and press Enter:

secpol.msc

Step 2: Open Password Policy

Navigate to:

Security Settings
└── Account Policies
    └── Password Policy

Step 3: Open the Complexity Setting

Double-click Password must meet complexity requirements.

Step 4: Select Disabled

Select Disabled, click Apply, and then click OK.

Step 5: Refresh Policy

Open an elevated Command Prompt or PowerShell window and run:

gpupdate /force

Test the change with a controlled local account. If a password is still rejected, investigate minimum length, password history, or another effective policy rather than assuming complexity is the cause.

Method 2: Disable Password Complexity with Local Group Policy

You can also reach the same local computer policy through gpedit.msc. Open an elevated Run dialog and enter:

gpedit.msc

Then go to:

Computer Configuration
└── Windows Settings
    └── Security Settings
        └── Account Policies
            └── Password Policy
                └── Password must meet complexity requirements

Open the setting, select Disabled, apply it, and refresh Group Policy.

Method 3: Disable Password Complexity for an Active Directory Domain

For the default password policy of an Active Directory domain, Microsoft provides the Set-ADDefaultDomainPasswordPolicy cmdlet. Its -ComplexityEnabled parameter accepts a Boolean value; $false disables password complexity and $true enables it. citeturn0search1

Step 1: Review the Current Domain Policy

Before changing anything, inspect the current configuration:

Get-ADDefaultDomainPasswordPolicy -Identity "example.com" |
    Select-Object ComplexityEnabled,
                  MinPasswordLength,
                  PasswordHistoryCount,
                  MinPasswordAge,
                  MaxPasswordAge

Replace example.com with your domain name. Recording these values gives you a baseline for verification and rollback.

Step 2: Disable Complexity

If the approved change is specifically to remove the complexity requirement, change only that property:

Set-ADDefaultDomainPasswordPolicy `
    -Identity "example.com" `
    -ComplexityEnabled $false

Step 3: Verify the Result

Get-ADDefaultDomainPasswordPolicy -Identity "example.com" |
    Select-Object ComplexityEnabled

The expected value is False. Microsoft documents this cmdlet for modifying the default password policy of an Active Directory domain. citeturn0search1

Do Not Confuse Local Policy with Domain Password Policy

This is one of the most important distinctions when troubleshooting Windows Server password requirements. A server can have a local password policy while users authenticated against Active Directory are governed by domain policy.

If you disable complexity on a member server with secpol.msc but a domain user’s password is still rejected, inspect the domain’s effective policy instead of repeatedly changing the local setting.

Method 4: Use Fine-Grained Password Policy for Specific Users

If only a particular group needs a different password requirement, changing the default domain policy may be unnecessarily broad. Windows Server 2025 supports Fine-Grained Password Policies (FGPP), which allow different password and account-lockout policies for different sets of users within the same domain. citeturn0search0

For example, an administrator can create a dedicated policy:

$policyParams = @{
    Name = "LabPasswordPolicy"
    ComplexityEnabled = $false
    MinPasswordLength = 12
    PasswordHistoryCount = 10
    Precedence = 10
    ReversibleEncryptionEnabled = $false
    ProtectedFromAccidentalDeletion = $true
}

New-ADFineGrainedPasswordPolicy @policyParams

Assign it to a security group:

Add-ADFineGrainedPasswordPolicySubject `
    "LabPasswordPolicy" `
    -Subjects "Lab Users"

Microsoft documents FGPP specifically for applying different password and account-lockout requirements to different sets of users in an AD domain. citeturn0search0

How to Check the Effective Policy for an AD User

After creating or assigning an FGPP, check the resultant policy rather than assuming the new policy is being applied.

Get-ADUserResultantPasswordPolicy -Identity testuser

You can also use Active Directory Administrative Center to view the resultant password policy for a user. This is useful when multiple password policies exist in the same domain. citeturn0search0

Verify Group Policy on Windows Server 2025

If Group Policy is involved, generate a Resultant Set of Policy report:

gpresult /h C:\Temp\gpresult.html

Open the generated HTML report and identify the policies applied to the computer. Look for the GPO that defines the password policy and investigate conflicting settings, scope, security filtering, and organizational-unit placement.

Do not treat the presence of a setting in one GPO as proof that it is the final effective configuration. In an enterprise environment, the policy that matters is the policy actually applied to the affected account or computer.

What Changes When Password Complexity Is Disabled?

Disabling the complexity setting removes the built-in composition requirement. It does not automatically change other password controls.

Security Risks of Removing Password Complexity

Removing complexity can make it easier for users to choose short or predictable passwords. That matters because a password policy is only one part of an organization’s credential-security model.

Microsoft’s Windows Server security guidance emphasizes testing security baseline changes before production deployment. Windows Server 2025 also supports stronger authentication and credential-protection mechanisms that can be used alongside password policy. citeturn0search5turn0search4

If the goal is better usability rather than compatibility, consider longer passphrases and stronger authentication instead of simply reducing password requirements. For managed local administrator accounts, Windows LAPS in Windows Server 2025 also provides additional password-generation options, including passphrase-oriented complexity modes. citeturn0search3turn0search6

When Should You Avoid Disabling Password Complexity?

• Domain Administrator and other privileged accounts: keep stronger controls for high-value credentials.
• Production domain controllers: avoid weakening the domain’s general credential baseline without a documented requirement.
• Internet-facing systems: weak credentials increase exposure to password-guessing and credential attacks.
• VPN and remote-access infrastructure: combine strong credentials with appropriate MFA and access controls.
• Shared or service accounts: investigate managed service accounts or other alternatives before relaxing password requirements.

Common Troubleshooting Scenarios

The password is still rejected

Check minimum password length, password history, account restrictions, and the effective domain or fine-grained password policy. Disabling complexity does not make every password valid.

I changed gpedit.msc but domain users are unaffected

Check the Active Directory domain policy. The local policy on a member server is not the same as the password policy controlling domain users.

Only one group needs a different requirement

Use a Fine-Grained Password Policy instead of modifying the default domain policy. FGPP is specifically designed for different password and lockout requirements within a domain. citeturn0search0

The policy keeps changing back

Identify the GPO that owns the effective setting. A local change can be superseded by centrally managed policy, so verify the source of the setting before making repeated local changes.

Recommended Administrator Workflow

1. Identify scope: local account, domain account, or selected AD group.
2. Inspect current policy: record complexity, length, history, and age settings.
3. Choose the narrowest change: local policy, domain policy, or FGPP.
4. Apply the change: use the appropriate Microsoft management tool.
5. Refresh and verify: use gpupdate, gpresult, or AD resultant-policy commands as appropriate.
6. Test safely: use a non-production account before touching privileged credentials.
7. Document the exception: record the business or technical reason, scope, owner, and rollback procedure.

Summary

To remove password complexity in Windows Server 2025, change the Password must meet complexity requirements setting under the applicable Password Policy. For a standalone server, secpol.msc is a straightforward choice. For an Active Directory domain, use the appropriate domain password policy and, where appropriate, Set-ADDefaultDomainPasswordPolicy. citeturn0search1turn0search7

If the requirement applies only to a particular group, a Fine-Grained Password Policy is the more targeted Active Directory mechanism. Windows Server 2025 supports FGPP and provides tools to view the resultant policy for a user. citeturn0search0

The safest implementation is to change only the setting required for the documented use case, preserve other password protections, verify the effective policy, and test before applying the change to production.

Frequently Asked Questions

Does disabling password complexity remove the minimum password length?

No. Password complexity and minimum password length are separate policy settings. Disabling complexity leaves the configured minimum length in place.

Does the change affect existing passwords?

The complexity requirement is enforced when passwords are created or changed. Disabling the setting does not automatically replace existing passwords. citeturn0search7

Can I disable complexity for one Active Directory user?

The default domain password policy is not a simple per-user override. For targeted requirements, use a Fine-Grained Password Policy and assign it to the appropriate user or security group. citeturn0search0

Can PowerShell disable password complexity?

Yes. For the default AD domain policy, use Set-ADDefaultDomainPasswordPolicy with -ComplexityEnabled $false. Review and record the existing policy before changing it. citeturn0search1

Is disabling password complexity recommended for production?

It should be treated as a controlled exception, not a default security configuration. Consider targeted policies, longer passwords or passphrases, MFA, managed accounts, and other credential protections first.

Where is the Windows Server 2025 password complexity setting?

Computer Configuration
→ Windows Settings
→ Security Settings
→ Account Policies
→ Password Policy
→ Password must meet complexity requirements

Editorial note: This guide is intended for IT administrators and system engineers. Test security-policy changes in a controlled environment before applying them to production Active Directory or Windows Server infrastructure. Internal links below are placeholder suggestions and should be replaced with the corresponding published VMoreCloud URLs.