Password policy enforcement

If check_policy is on,

• check_expiration is also on, unless set to off explicitly
• Password history is initialized with the value of current password hash

If check_policy is off,

• check_expiration is set to off
• Password history is cleared
• Value of lock_out time is reset