Depending on how the virtual machine is configured, the password complexity may be a requirement that's enforced by the system's security settings.
- On the virtual machine, run
- Navigate to:
Security Settings\Account Policies\Password Policy
- Observe the value for "Password must meet complexity requirements"
By default, standalone systems have this disabled. Domain controllers, and other systems that are members of a domain, have it enabled by default. If the system is not a domain controller or domain member, it's possible that the developers manually applied a security template to the VM.
If you double-click that setting, and go to the "Explain" tab, you'll see exactly what this policy enforces. I've also listed the requirements below.
The password must...:
- Not contain the user's account name.
- Not contain more than two consecutive characters out of the user's full name.
- Be at least six characters in length (unless another minimum length is specified).
- Contain characters from 3 of the 4 character types:
- Uppercase letters
- Lowercase letters
- Non-alphanumeric characters
If the setting is disabled, then another possibility is that
Passw0rd is just a one-size-fits-all, generic password that the developers are accustomed to using so that it will be accepted on any system they're testing. (Though, it should be noted that this would not be accepted on any systems using CIS/NIST security templates - those require a minimum of 12 characters.)