设置本地安全策略

通过secedit工具设置本地安全策略

#定义需要配置的密码策略
$passpolicy = @'
[Unicode]
Unicode=yes
[System Access]
MinimumPasswordAge = 0
MaximumPasswordAge = 95
MinimumPasswordLength = 8
PasswordComplexity = 1
PasswordHistorySize = 10
[Version]
signature="$CHICAGO$"
Revision=1
'@

$dir_temp = "C:\Windows\Temp"
$secpolicy_file_custom = Join-Path $dir_temp "localpasswordpolicy.cfg"
If (Test-Path $secpolicy_file_custom) {Remove-Item $secpolicy_file_custom -Force}
$passpolicy |Out-File $secpolicy_file_custom

#导入新的安全策略模板（指定要应用到系统的安全性范围为SECURITYPOLICY）
secedit /configure /db C:\Windows\security\database\localpass1.sdb /cfg $secpolicy_file_custom  /areas SECURITYPOLICY /quiet
sleep -Seconds 1
If (Test-Path $secpolicy_file_custom) {Remove-Item $secpolicy_file_custom -Force}

 

 

 

#更改本地策略:设置密码永不过期、禁用密码复杂度
$CurrentPath = $MyInvocation.MyCommand.Path.substring(0,$MyInvocation.MyCommand.Path.LastIndexOf('\')+1)
If (Test-Path secedit.sdb) {Remove-Item secedit.sdb -Force}
$secfile = join-path $CurrentPath "secpol.cfg"
#导出当前安全策略模板
secedit /export /cfg $secfile /quiet
#禁用密码复杂度，设置密码永不过期
((gc $secfile) -replace "PasswordComplexity = 1", "PasswordComplexity = 0" ) -replace "MaximumPasswordAge = 42","MaximumPasswordAge = -1"| Out-File $secfile -force
#导入新的安全策略模板（指定要应用到系统的安全性范围为SECURITYPOLICY）
secedit /configure /db secedit.sdb /cfg $secfile /areas SECURITYPOLICY /quiet
Remove-Item $secfile -Force
Remove-Item secedit.sdb -Force