SQL Server 2017 password complexity rule SQL and Windows version: Microsoft SQL Server 2017 (RTM-CU19) (KB4535007) - 14.0.3281.6 (X64)   Jan 23 2020 21:00:04   Copyright (C) 2017 Microsoft Corporation  Developer Edition (64-bit) on Windows Server 2016 Standard 10.0  (Build 14393: ) (Hypervisor) 

Servers are in Workgroup.

Our Password Complexity Parameters for SQL login:


has at least one digit
has at least one uppercase character
has at least one special character
has at least one lowercase character


We are able set initial password for new SQL login as a TestingDB@001 and testingdb@001. But new initial password should be TestingDB@001 NOT testingdb@001 as per above Complexity Parameters. Is this expected behaviour of SQL 2017 for SQL login password?

We have tried to create OS user (non admin windows account), OS level also its taking both passwords (TestingDB@001 and testingdb@001). As per above Complexity Parameters, it should accept only TestingDB@001 password. Is the above SQL login password issue is due to OS?

Please suggest how to achieve above Complexity Parameters in password creation.

We have set below policy in local computer policy on DB server.
Is this expected behaviour of SQL 2017 for SQL login password?


Yes, it is expected. You might have overlooked the three of the following four categories part of the Password Complexity doc:


  
  The password contains characters from three of the following four    categories:
  
  
  Latin uppercase letters (A through Z)
  Latin lowercase letters (a through z)
  Base 10 digits (0 through 9)
  Non-alphanumeric characters such as: exclamation point (!), dollar    sign ($), number sign (#), or percent (%).
  
  


Therefore the password TestingDB@001 has characters from the four categories while testingdb@001 has characters from three (which is the minimum acceptable to pass), so both passwords are in accordance with the policy.

As for the Windows login it has a policy Reference that is quite like the one from SQL Server and also says The password contains characters from three of the following categories.