@Guillaume - I'm not a MS apologist, but, the canonical way to set that good local password policy is via GPO... you're also at the mercy of users not creating new local accounts; or changing their strong password to a weak one - From a management PoV even provisioning new users / machines / email addresses is very hard in Windows-land sans AD/Domain. 1k users sans AD/Domain whilst would certainly be do-able and is an interesting thought experiment... i fear in all practical senses would likely have lesser security than the org with the domain that can get eternal-blued to ransomware heaven