(ITS#6544) how to implement password policy