Maximum password age
This security setting defines how many days a password may be used before Windows requires it to be changed.
since 0.9.8.11
Purpose
Account policy: net accounts /maxpwage:unlimited
This security setting defines how many days a password may be used before Windows requires it to be changed. A value of 0 means that passwords do not expire because of their age. Users are therefore not prompted to choose a new password solely because a certain amount of time has passed since the previous password change.
When applied as a local account policy, the setting governs passwords for local user accounts on the computer. Password expiration for domain accounts or Microsoft Entra accounts is controlled by the applicable domain or cloud service instead.
This setting does not change password length, complexity, history, account-lockout rules, or other sign-in requirements. Users and administrators can still change or reset passwords.
Notes
Security
With a maximum password age of 0, a compromised password is not invalidated after a predefined interval. It may remain usable until the password is changed or reset, or until the affected account is disabled.
Microsoft also notes that mandatory periodic password changes can encourage undesirable behavior, such as predictable password variations. Microsoft security baselines therefore do not prescribe password expiration where more effective protections against password attacks are in place. Disabling expiration does not, by itself, detect or remediate compromised credentials.
Possible side effects
Time-based password-change prompts no longer occur. Consequently, this setting does not satisfy processes or compliance requirements that mandate periodic password changes.
Notes
Windows interfaces use different representations for an unlimited password lifetime. In the policy user interface, 0 means that passwords never expire. For net accounts, however, Microsoft documents /MAXPWAGE:UNLIMITED, while numeric values are specified as a range from 1 through 999 days. /maxpwage:0 is therefore not a Microsoft-documented command form.
In a security template, the Microsoft protocol specification encodes the same unlimited state as MaximumPasswordAge = -1. These representation differences do not change the resulting policy behavior.
A locally saved change takes effect without a restart. On a domain-joined computer, the local setting does not replace the domain password-expiration policy for domain accounts.
Microsoft documentation
Microsoft Learn: Maximum password age
Microsoft Learn: Net Commands On Operating Systems
Microsoft Learn: Password Policies protocol specification