The Effects of Changes on Existing Policies
Except for the password format policies described in Password Format, policy changes affect all existing accounts and all accounts that you create after the change.
Changes to password format policies, such as password length, whether passwords can consist of all spaces, and whether passwords can consist of all alphanumeric characters, affect only passwords for those accounts that are created after the policy is changed. The changes have no effect on existing passwords. For example, if you change the minimum password length policy to enforce a longer length password, existing passwords that are shorter than the length specified by the new policy are unaffected. They do not need to be changed, but any new passwords that are created must adhere to the new policy. However, the next time you change an existing password, the longer length policy is enforced.