Set the global password policy for SEM users

In the Authentication settings, you can set minimum password requirements for local SEM user accounts, require new passwords to differ sufficiently from the current password, and set how often passwords expire. Only administrators can change these settings.

1. On the SEM Console, click the Settings button.

   

2. On the Settings page, click the Authentication tab, and then select Local Users.
3. To require complex passwords for SEM users, click the Password Restrictions toggle button.

   Passwords should be at least nine-characters long, cannot contain user names or control characters, or be longer than 40 characters.

   Complex passwords must include any three of the following four character types:

   • One upper-case letter
   • One lower-case letter
   • One Number
   • One special character (!, @, #, etc.)

   In the FIPS edition of SEM, the minimum password length is 14 characters.

4. To require that a new password differs sufficiently from the current password, turn on the Passwords must differ sufficiently from the current password toggle.

   This option is turned off by default. When it is turned on, a new password must differ from the current password in at least 8 character positions. See How the password difference check works.

5. Adjust the Minimum Password Length setting according to your preference.

6. In the PASSWORD EXPIRY section (below the password history settings), configure password expiration:

   • Password expiry is enabled by default. To turn it off, clear the option.
   • Enter the number of days after which a password expires. The default is 90 days. You can enter a value from 1 to 365 days.
7. Click Save.

How password expiry works

• When a local user's password is older than the expiration period, the user must change the password the next time they log in. SEM does not warn users before their password expires, and there is no grace period.
• When you upgrade to SEM 2026.4, the last-changed date of the password of every existing local user is set to the time of the upgrade. Users are not forced to change their passwords immediately after the upgrade; their passwords expire when the expiration period has passed after the upgrade.
• If you enter an expiration period outside the allowed range, a message informs you that the password expiration cannot be smaller or greater than the allowed value.
• Changes to the password expiry settings are logged, for example "Password expiration enforcement enabled" or "Password expiration period changed from 90 to 60 days".

How the password difference check works

• When the Passwords must differ sufficiently from the current password option is turned on, a new password must differ from the current password in at least 8 character positions. If the current password is shorter than 8 characters, the new password must differ in every position of the current password.
• The check applies only when the current password is entered, which happens when a user changes their own password or when a user must change an expired password at login. It does not apply when an administrator sets the password of another user.

• If the new password is too similar, SEM displays the following message:

  New password is too similar to the current password. Please choose a more different password.

• The number of character positions is set by the module.LocalUserPlugin.minChangedPositions property in the manager.conf file (default 8). Setting it to 0 disables the check.