I have downloaded a couple of Virtual Machine images from http://modern.ie, in order to test different versions of Internet Explorer.

When running these images, a complete Windows environment is started, with a default user account. The details for the user account are displayed in clear text on the Windows desktop background:

Screenshot of the Windows desktop

What is the reason for complicating the password (e.g. Passw0rd! instead of just password), when the password is clearly visible to anyone, and is supposed to be public?

  • 27
    I doubt there's a real thought-through reason for it. Smacks of cargo-cult to me: a password must have some funny characters and numbers. stevemcconnell.com/ieeesoftware/eic10.htm Commented Aug 21, 2015 at 8:34
  • 3
    So, in this particular case, it's probably because that's the Well Known demo password.
    – Steve
    Commented Aug 21, 2015 at 16:54
  • 1
    It also stops run-of-the-mill exploits from pwning your system by guessing the ubiquitous "password" password.
    – sleblanc
    Commented Aug 24, 2015 at 1:47

6 Answers 6


In addition to the password policy (upper case+lower case letters, number, non alphanumeric character, >8 digits), it also leads to clarity. Some users might be confused by the password being password, depending how it's displayed, especially if it's mixed with other information. Yet for all but the mentally challenged users it's immediately clear that Passw0rd! is a password, which reduces the amount of support queries.

  • 3
    «Some users might be confused by the password being password» - very good point. Commented Aug 22, 2015 at 19:59
  • 1
    Make the password "allonewordlowercasenospaces".
    – Schwern
    Commented Aug 22, 2015 at 20:04
  • Or even better "All One W0rd Lower Case No Spaces With Quotes".
    – Prateek
    Commented Aug 24, 2015 at 8:17
  • 1
    I am marking this answer as accepted, as I liked the it's immediately clear that Passw0rd! is a password point. As stated in other comments, password policies were not the issue. Commented Aug 24, 2015 at 8:47
  • 5
    This reminds me of my old school: the root account for the classroom server had the password "dasgleiche" ("the same" in German). You could literally tell another admin loudly "the password is the same" with 30 students listening and none of them would ever get it. Commented Aug 24, 2015 at 10:04

Reason may be:

This Windows has implemented a strong password policy, thus the user MUST HAVE a "strong" password.

  • 10
    "strong" haha ­­­­ Commented Aug 22, 2015 at 12:13
  • 4
    Well, no. I had no problems changing the password to password, so policies can't be the reason. Commented Aug 24, 2015 at 7:16
  • @VidarS.Ramdal, perhaps other systems have stricter password policies that would not let you make such a change, yet they want to use the same password on all systems for simplicity.
    – Kat
    Commented Aug 26, 2015 at 15:19
  • It a seems all those VM images use the same password and policies. Commented Aug 26, 2015 at 17:52

Password policy.

You have to jump trough some hoops to get Windows to accept "password" (no capitals, no digits, no non-alphanumerics).

But it will accept "Passw0rd!" right out of the box.

  • 3
    I was able to change the password to password without any problems. Commented Aug 24, 2015 at 7:16
  • @VidarS.Ramdal: Thanks! I guess I was thinking about domain joined machines and thought that this applied to all standalone Windows machines as well. Commented Sep 7, 2015 at 7:25

Depending on how the virtual machine is configured, the password complexity may be a requirement that's enforced by the system's security settings.

  1. On the virtual machine, run secpol.msc.
  2. Navigate to: Security Settings\Account Policies\Password Policy
  3. Observe the value for "Password must meet complexity requirements"

By default, standalone systems have this disabled. Domain controllers, and other systems that are members of a domain, have it enabled by default. If the system is not a domain controller or domain member, it's possible that the developers manually applied a security template to the VM.

If you double-click that setting, and go to the "Explain" tab, you'll see exactly what this policy enforces. I've also listed the requirements below.

The password must...:

  • Not contain the user's account name.
  • Not contain more than two consecutive characters out of the user's full name.
  • Be at least six characters in length (unless another minimum length is specified).
  • Contain characters from 3 of the 4 character types:
    • Uppercase letters
    • Lowercase letters
    • Numbers
    • Non-alphanumeric characters

If the setting is disabled, then another possibility is that Passw0rd is just a one-size-fits-all, generic password that the developers are accustomed to using so that it will be accepted on any system they're testing. (Though, it should be noted that this would not be accepted on any systems using CIS/NIST security templates - those require a minimum of 12 characters.)

  • The setting is disabled, so password policies is not the reason. Commented Aug 24, 2015 at 7:44
  • Then the developers who built the system are really the only people who can answer for this.
    – Iszi
    Commented Aug 25, 2015 at 14:42

The only reason I can think of, is the case when the password is meant to be changed and they want to indicate to the users that they should use a complex password.

  • I disagree, there's no reason to change the password in a virtual machine dedicated to use the Edge browser. Commented Aug 24, 2015 at 12:14
  • I was reffering to the generic question in the topic, but I agree with you, that in this situation this is not the reason and way more accurate answers have been posted here.
    – bayo
    Commented Aug 24, 2015 at 12:37

The site you point to is a site for developer tools, and specifically VMs created for the sole purpose of testing different versions of IE.

Casually released developer tools like this normally are given far less scrutiny, and are less polished than a full release of a major product. There's really no good reason why Passw0rd! is any more secure than password, especially when it's public. It's likely that the developer who created the VM didn't give it more than 2 minutes worth of thought, and it was never scrutinized beyond that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .