Local Security Policy (secpol.msc)

Run: secpol.msc

Overview

A focused subset of Local Group Policy covering security-specific settings. Available on Windows Pro and above. On domain-joined machines, domain GPO security settings take precedence. Ideal for standalone machines, workgroup servers, or initial hardening baselines.

Account Policies — Password Policy

Enforce password history: 12+ passwords remembered
Maximum password age: 90 days (or per org policy)
Minimum password age: 1 day (prevents rapid cycling)
Minimum password length: 14 characters (NIST 800-63B recommends length over complexity)
Password must meet complexity requirements: Enabled

Account Lockout Policy

Account lockout threshold: 5 invalid attempts
Account lockout duration: 15 minutes (0 = admin must unlock)
Reset account lockout counter after: 15 minutes

Audit Policy

Enable these categories to populate the Security event log:

Audit account logon events: Success, Failure
Audit account management: Success, Failure
Audit logon events: Success, Failure
Audit object access: Failure (enable Success only for specific sensitive folders)
Audit policy change: Success, Failure
Audit process tracking: Success (generates Event ID 4688)
Audit privilege use: Failure

User Rights Assignment — Key Entries

Review SeImpersonatePrivilege — should only be held by LOCAL SERVICE, NETWORK SERVICE, and IIS AppPool accounts, not regular users.

Baseline Reference

Microsoft Security Compliance Toolkit provides downloadable .PolicyRules files with recommended baselines for Windows 10/11 and Server versions. Import with LGPO.exe for automated application.