Turn off password security in Input Panel
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Vista
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Tablet PC\Input Panel Description
Adjusts password security settings in Touch Keyboard and Handwriting panel (a.k.a. Tablet PC Input Panel in Windows 7 and Windows Vista). These settings include using the on-screen keyboard by default, preventing users from switching to another Input Panel skin (the writing pad or character pad), and not showing what keys are tapped when entering a password. Touch Keyboard and Handwriting panel enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. If you enable this policy and choose “Low” from the drop-down box, password security is set to “Low.” At this setting, all password security settings are turned off. Users will not be able to configure this setting in the Input Panel Options dialog box. If you enable this policy and choose “Medium-Low” from the drop-down box, password security is set to “Medium-Low.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel displays the cursor and which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. If you enable this policy and choose “Medium” from the drop-down box, password security is set to “Medium.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is not allowed, and Input Panel displays the cursor and which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. If you enable this policy and choose to “Medium-High” from the drop-down box, password security is set to “Medium-High.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. If you enable this policy and choose “High” from the drop-down box, password security is set to “High.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is not allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. If you disable this policy, password security is set to “Medium-High.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. If you do not configure this policy, password security is set to “Medium-High” by default. At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will be able to configure this setting on the Advanced tab in Input Panel Options in Windows 7 and Windows Vista. Caution: If you lower password security settings, people who can see the user’s screen might be able to see their passwords.
Registry
software\policies\microsoft\TabletTip\1.7 Value name: PasswordSecurityState
Enabled: PasswordSecurityState = 1
Disabled: PasswordSecurityState = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/PasswordSecurity_2 Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Turn off password security in Input Panel
; State: Enabled
; Supported on: At least Windows Vista
[HKEY_LOCAL_MACHINE\software\policies\microsoft\TabletTip\1.7]
"PasswordSecurityState"=dword:00000001
"PasswordSecurity"=dword:00000001More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Turn off password security in Input Panel
# State: Enabled
# Supported on: At least Windows Vista
$path = 'HKLM:\software\policies\microsoft\TabletTip\1.7'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PasswordSecurityState' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'PasswordSecurity' -Value 1 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/PasswordSecurity_2
Data type: String
Value:
<enabled/>
<data id="PasswordSecurity" value="1"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Turn off password security in Input Panel
# State: Enabled
# Supported on: At least Windows Vista
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\TabletTip\1.7' -Name 'PasswordSecurityState' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\TabletTip\1.7' -Name 'PasswordSecurity' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Turn off password security in Input Panel
# State: Enabled
# Supported on: At least Windows Vista
$path = 'HKLM:\software\policies\microsoft\TabletTip\1.7'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PasswordSecurityState' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'PasswordSecurity' -Value 1 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Turn off password security in Input Panel
# State: Enabled
# Supported on: At least Windows Vista
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Turn off password security in Input Panel
# State: Enabled
# Supported on: At least Windows Vista
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\TabletTip\1.7' -Name 'PasswordSecurityState' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\TabletTip\1.7' -Name 'PasswordSecurity' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Turn off password security in Input Panel
# State: Enabled
# Supported on: At least Windows Vista
$path = 'HKLM:\software\policies\microsoft\TabletTip\1.7'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PasswordSecurityState' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'PasswordSecurity' -Value 1 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.