SQL Server Enforce Password Policy

Question

In SQL Server, I understand when the "Enforce password policy" is checked for accounts with SQL authentication, it will pull from the O/S.

If "enforce password policy" is checked and "enforce password expiration" is not checked, will the SQL account's password inherit the expiration of 90 days? Or do both have to be checked?

Does "enforce password policy" override the "enforce password expiration" whether it's checked or not?

Answer 1

The password policy applies to restrictions around Windows password policy, including things like:

• An uppercase character (A-Z).
• A lowercase character (a-z).
• A digit(0-9).
• One of the non-alphanumeric characters, such as a space, _, @,
  *, ^, %, !, $, #, or &.

It does not handle expiration checks, you need to have the check expiration set for that to happen.

Reference MSDN Create Login