Do not allow password expiration time longer than required by policy

Supported on: At least Microsoft Windows 10 or later

Registry

HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS

Value name: PasswordExpirationProtectionEnabled

Enabled: PasswordExpirationProtectionEnabled = 1

Disabled: PasswordExpirationProtectionEnabled = 0

Description

If this setting is enabled or not configured, planned password expiration longer than the password age dictated by the "Password Settings" policy is NOT allowed. When such expiration is detected, the password is changed immediately and password expiration is set according to policy. If this setting is disabled, password expiration time may be longer than required by "Password Settings" policy. See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.