在Windows Server 2016中更新策略模板以纳入放宽密码最小长度限制功能

Hey there, let's break down your question and cover both the template update attempt and practical workarounds since Windows Server 2016 doesn't natively support this 2022-specific password policy feature.

Can you update the policy template to add the setting? #

Short answer: You can import the Windows Server 2022 ADMX templates, but it likely won't work as expected. Here's why and how to try anyway:

• The "relax minimum password length limits" setting is tied to Windows Server 2022's Active Directory functionality and domain functional level support. Even if the ADMX template shows up in Group Policy Editor, Windows Server 2016's domain controllers don't have the underlying code to enforce this policy.
• If you still want to test importing the template:
  1. On a Windows Server 2022 machine, navigate to C:\Windows\PolicyDefinitions and copy the PasswordPolicy.admx file.
  2. Copy the corresponding language file (e.g., en-US\PasswordPolicy.adml) from the language subfolder in PolicyDefinitions.
  3. Paste these files into your domain's Central Store (if configured: \\[YourDomainName]\SysVol\[YourDomainName]\Policies\PolicyDefinitions) or the local C:\Windows\PolicyDefinitions folder on your 2016 DC.
  4. Close and reopen Group Policy Management Console (GPMC) or Local Group Policy Editor (gpedit.msc) to check if the setting appears.
     Note: Even if it shows up, applying the policy won't affect domain accounts because 2016 DCs can't process this new rule.

Practical workarounds to achieve similar results #

Since the native setting won't work on 2016, here are reliable alternatives:

1. Custom Password Filter DLL #

Windows allows custom password filters to override default password policies. You can either:

• Develop a custom DLL that bypasses the minimum password length requirement for specific users/groups (requires C/C++ development knowledge).
• Use a trusted third-party password filter tool that offers granular control over password length rules.
  Important: Test any custom or third-party filter in a non-production environment first to avoid locking out accounts.

2. Targeted local policy exceptions (for local accounts only) #

If you're dealing with local server accounts (not domain accounts), you can adjust the registry directly:

• Open Registry Editor (regedit.exe) and navigate to HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters.
• Create or modify the MinimumPasswordLength DWORD value, setting it to 0 to allow empty passwords or a lower number than the default.
• Restart the Netlogon service for changes to take effect.
  This won't work for domain accounts, which are governed by domain-level password policies.

3. Upgrade domain functional level (big-picture approach) #

If your environment can handle it, upgrading your domain functional level to Windows Server 2022 will unlock the native "relax minimum password length limits" setting. Here's what to consider:

• You'll need at least one Windows Server 2022 domain controller in your domain first.
• Upgrading the functional level is irreversible (you can't go back to 2016), so ensure all domain-joined devices and applications are compatible with Server 2022's functional level.
• Once upgraded, you can manage the policy from a 2022 DC, and all DCs (including 2016) will enforce it since the policy is stored in Active Directory.

备注：内容来源于stack exchange，提问作者Chia Wei