--- title: Local user password strength enforcement details slug: epmm/getting-started-guide/local-user-password-strength-enforcement-details createdAt: 2026-10-06T07:50:24.842Z --- The following table summarizes the fields of the local user password policy when using password strength enforcement: Table: Fields for local user password strength enforcement | Field | Description | Default value | | ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | | Enable Password Strength Enforcement | Select this field when you want to apply password strength requirements to local user passwords. | Not selected | | Number of Failed attempts | Specify the number of failed attempts that a local user can make when entering his password.
After this number of attempts, Ivanti EPMM does not allow the user to login until the specified auto-lock time has expired. After the auto-lock time expires, each failed login attempt results in Ivanti EPMM not allowing the user to login until the auto-lock time expires again.
Valid values are 1 through 16. | 5 | | Auto-Lock Time | Specify how much time in seconds, minutes, hours, or days the local user must wait before he can log in after exceeding the number of failed attempts.
Valid values are 0 through 3600 seconds (60 minutes). | 30 seconds | | Enforce Passcode History (Last 4 passwords) | Select Enable if you do not want to allow a local user to use the previous 4 passwords when changing his password.
To allow a local user to use the previous 4 passwords, select Disable. | Enable | | Password Strength | Select a value between 0 and 100, where 0 is the weakest requirement, and 100 is the strongest requirement.
You can enter a value or move the slider.
For details, see [Local user password strength value descriptions](docId\:e340_PDR-cSo658_rTjql). | 35 | **Related topics ** - [Local user password policy overview](docId\:VCgdR_tnONTuxPGapnXVM) - [Setting the password policy for local users](docId\:xz6rFw0IFIfcslDyQosk3) ## Local user password strength value descriptions The following table describes the local user password strength values: Table: Local user password strength value descriptions | Strength value | Description | Examples | | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 0 - 20 | Weak: risky password | - Few characters: ;">zxcvbn
- Sequences: ;">abcdefghijk987654321
- Names: ;">briansmith4mayor
- Words: ;">viking
- Words with number substitutions: ;">ScoRpi0ns | | 21 - 40 | Fair: protection from throttled online attacks
Throttled online attacks are attacks to guess the passcode which are:
- on the device
- rate-limited
Rate-limited attacks are limited to some number of attempts per time period. | - Few characters but with special characters: ;">qwER43@!
- Words plus numbers: ;">temppass22
- Names plus numbers: ;">ryanhunter2000
- Words with special character and number substitutions: ;">R0$38uD99
- Names with capitalization: ;">verlineVANDERMARK | | 41 - 60 | Good: protection from unthrottled online attacks
Unthrottled online attacks are attacks to guess the passcode which are:
- on the device
- not rate-limited | - Longer words with special character and number substitutions: ;">Tr0ub4dour&3
- Longer phrases with numbers and special characters: neverforget13/3/1997
- Longer letter, number, and special character combinations: ;">asdfghju7654rewq, AOEUIDHG&\*()LS | | 61 - 80 | Strong: moderate protection from offline slow-hash scenario
An offline slow-hash scenario is a sophisticated algorithm for guessing a passcode. The algorithm runs offline from the device after copying passcode-related files from the device. | - Longer random letters and numbers:
- zevusqr3
- resqu3Wil
- tgbvdnjuk
- Longer phrases with numbers and special characters: Compl3xChar$ | | 81 - 100 | Very strong: strong protection from offline slow-hash scenario | - Very long random characters:
- eheuczkqyq
- rWibMFACxAUGZmxhVncy
- Ba9ZyWABu99\[BK#6MBgbH88Tofv)vs$w
- Long phrases: ;">correcthorsebatterystaple
- Long phrases with substitutions: coRrecth0rseba++ery9.23.2007staple$ | **Related topics**  - [Local user password policy overview](docId\:VCgdR_tnONTuxPGapnXVM) - [Setting the password policy for local users](docId\:xz6rFw0IFIfcslDyQosk3)