Servers – Ensure Inactive Password Lock is 30 Days or Less

Support > Fixing Checks > Server

06 March, 2026

This check ensures that inactive password lock is configured to 30 days or less.

The inactivity period defines how long a user account remains active after the password expires. Limiting this value helps prevent unused accounts from being exploited.

Check Details

Resource: Server
Check: Ensure inactive password lock is 30 days or less
Risk: Inactive user accounts can be exploited without detection, increasing the risk of unauthorized access.

Remediation Steps

Open a terminal session with root or sudo privileges.
Check the default inactivity period:
```
useradd -D | grep INACTIVE
```

Verify inactivity settings for all users:

grep -E ^[^:]+:[^\!*] /etc/shadow | cut -d: -f1,7

Set the default inactivity period to 30 days:
```
sudo useradd -D -f 30
```
Update inactivity settings for individual users:
```
sudo chage --inactive 30 <username>
```
Optionally, verify directly from /etc/shadow file:
```
cat /etc/shadow
```
Ensure that the 7th field (INACTIVE) is set to 30 or less for all users.
Perform periodic audits to maintain compliance.

Other Articles

Servers – Ensure Inactive Password Lock is 30 Days or Less

Check Details

Remediation Steps