Windows 10 password policy fails when a local account cannot change passwordSolved

Hello,

Thanks for reaching out to Hexnode Connect.

Yes, if even a single local account on the Windows device has the “User cannot change password” setting enabled, Windows can block the password policy from applying successfully to the device. For the policy to deploy correctly, all local accounts must allow password changes.

To manually fix this on an affected device:

1. Open Computer Management on the Windows device.
2. Navigate to System Tools > Local Users and Groups > Users.
3. Open each affected local user account.
4. In the General tab, uncheck User cannot change password and apply the changes.
5. Trigger a Sync Device action from the Hexnode portal so the password policy is re-evaluated.

Once all local accounts on the device allow password changes, the policy should move out of the “Failed” state upon the next successful sync.

I hope this helps. Feel free to reach out if you have any further queries.

Best regards,
George,
Hexnode UEM

That makes sense, and checking those accounts manually confirmed the mismatch. However, we have hundreds of devices and cannot manually access Computer Management on every single laptop. Is there a way to push this change in bulk from the Hexnode portal?

Hello,

Hexnode does not provide a native UI toggle to directly override the Windows local account password restriction, as that setting is stored at the Windows account level.

However, for bulk remediation, you can resolve this remotely by executing a custom script. Here is the recommended workflow:

1. Create a PowerShell or batch script designed to identify local accounts where password changes are blocked and update their attributes to allow changes.
2. Test the script on a small pilot group of devices first.
3. Deploy it in bulk from the portal by going to Manage > Devices, selecting the affected devices, and clicking Actions > Execute Custom Script.
4. After the script execution completes, run a Sync Device action on those devices so the Windows password policy is evaluated and applied correctly.

This approach allows you to correct the local account conflict remotely without having to alter your 90-day compliance policy.

I hope this helps your bulk deployment! Feel free to reach out if you have any more doubts or need further assistance.

Best regards,
George,
Hexnode UEM