docs(ppe): scaffold Password Policy Enforcer v12.0

[JBogalecki-Netwrix]

Summary

• Scaffolds docs/passwordpolicyenforcer/12.0/ as a copy of 11.2, and registers it in src/config/products.js as isLatest/defaultVersion, with 11.2 marked hidden (still fully built and reachable by direct URL)
• v12.0.0.78 is the actual released build — confirmed against the community release notes, released 2026-08-20. This is an intentional promotion to default, not a premature placeholder cutover.
• Adds sidebars/passwordpolicyenforcer/12.0.js and repoints internal cross-links inside the new version folder from /docs/passwordpolicyenforcer/11.2/... to /docs/passwordpolicyenforcer/12.0/...
• Updates the build number from 11.2.0.148 to 12.0.0.78 in installer filenames, msiexec examples, and cmdlet sample output (installationclient.md, installationserver.md, cmdgetppeversion.md, cmdgetppeserverversion.md)
• Removes all image embeds from the v12.0 doc set (the copied 11.2 screenshots don't reflect the real v12.0 UI) and deletes the copied static/images/passwordpolicyenforcer/12.0/ folder; rewords every sentence that referenced a now-removed screenshot, including replacing the empty "Policy selection flowchart" section with a Mermaid diagram that exactly reproduces the original screenshot's decision tree
• Ports the fix from Removing %SystemRoot% mentions #1391 to both12.0 and 11.2: removes a stray %SystemRoot%. fragment left in a warning callout in admin/hibpupdater.md
• Converts the only PPE KB links that pinned a version (5 links across 2 KB articles) to version-less URLs, which resolve through the site's evergreen createRedirects alias to whichever version is current defaultVersion — verified against docusaurus.config.js's createRedirects/getLatestVersionUrlMap, not just claimed
• Updates docs/passwordpolicyenforcer/CLAUDE.md: adds the 12.0 row, marks 11.2 hidden, and rewrites the Cmdlets/Rules convention sections to reference "the current latest version" instead of hardcoding a version number, so they don't go stale on the next bump

Notes for reviewers

• Known content gap: per the release notes, v12.0.0.78 adds HIBP database version-tracking/alerting and renames some UI controls (Primary/Secondary Dictionary, Passphrases tab). This PR is a structural version scaffold — it has not yet been updated to document those specific feature/UI changes. Screenshots are also still pending real v12.0 captures. Tracking as follow-up work, not blocking this scaffold.
• docs-audit/passwordpolicyenforcer/review-list.csv (added via the dev merge, from a different PR) only tracks 11.2 paths and predates this version bump; regenerating it will need 12.0 picked up and 11.2's hidden status handled so /audit-fix doesn't lose coverage. Not touched in this PR.

Test plan

• Scoped build (DOCS_PRODUCT=passwordpolicyenforcer DOCS_PRODUCT_LATEST_ONLY=true npm run build) succeeds with no new broken links
• No [...]() image embeds or /images/passwordpolicyenforcer/12.0/ path references remain in the v12.0 doc set
• Every internal cross-link inside v12.0 resolves to an existing v12.0 file
• %SystemRoot% fragment confirmed removed from both 12.0 and 11.2
• Manual review of the reworded screenshot-reference prose for accuracy once real v12.0 UI is available
• Content pass to cover the v12.0-specific feature/UI changes named in the release notes

🤖 Generated with Claude Code

https://claude.ai/code/session_01X5R4A6vzRHbgT2b1S7hguR

---

Generated by Claude Code

Closes#1479

[github-actions]

Auto-Fix Summary

8 issues fixed, 17 skipped across 77 files

Category	Fixes
Dale: misplaced-modifiers	1
Dale: passive-voice	4
Dale: positional-references	2
Dale: wordiness	1

Skipped (needs manual review)	Reason
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdstartppehibpupdater.md:31 — Netwrix.FirstPerson	False positive — the 'I' is the PowerShell parameter alias in 'Can also use -I or -i' for the -Inc switch, not first person. Renaming it would document a nonexistent parameter.
docs/passwordpolicyenforcer/12.0/admin/hibpupdater.md:9 — Netwrix.FirstPerson	False positive — the 'I' is part of the third-party service name 'Have I Been Pwnd (HIBP)'. Proper nouns cannot be rewritten.
docs/passwordpolicyenforcer/12.0/admin/manage-policies/rules/compromised_rule.md:13 — Netwrix.FirstPerson	False positive — the 'I' is part of the linked third-party service name 'Have I Been Pwned' (https://haveibeenpwned.com/). Proper nouns cannot be rewritten.
docs/passwordpolicyenforcer/12.0/admin/manage-policies/rules/rules.md:40 — Netwrix.FirstPerson	False positive — the 'I' is a table cell listing the letters I/i in the character-substitution reference table, not first person.
docs/passwordpolicyenforcer/12.0/web-overview/installationweb.md:31 — Netwrix.FirstPerson	False positive — the 'I' is inside the verbatim UI control label 'I accept the terms of the license agreement' that the reader clicks in the Setup Wizard. Rewriting it would misname the control.
docs/passwordpolicyenforcer/12.0/evaluation/testing_the_password_policy.md:78 — Dale: passive-voice	heading text — not modified to avoid breaking anchor links
docs/passwordpolicyenforcer/12.0/admin/troubleshooting.md:78 — Dale: passive-voice	heading text — not modified to avoid breaking anchor links
docs/passwordpolicyenforcer/12.0/admin/compromisedpasswordcheck.md:61 — Dale: passive-voice	'Email has been sent' is literal report output reproduced in a sample table, not authored prose
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdconnectppe.md:37 — Dale: passive-voice	'Connection to PPE was established' is literal PowerShell console output in an EXAMPLE block
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdexportppeconfig.md:31 — Dale: passive-voice	'Configuration export has been successfully completed' is literal cmdlet output in an EXAMPLE block
docs/passwordpolicyenforcer/12.0/admin/hibpupdater.md:135 — Dale: wordiness	Condensing 'automate the tool to retrieve and/or prepare' would require resolving the 'and/or', which changes the technical meaning
docs/passwordpolicyenforcer/12.0/admin/troubleshooting.md:12 — Dale: wordiness	'PPE enforces a password policy assigned to some users for all users' is already ambiguous; any rewrite would guess at the intended meaning
docs/passwordpolicyenforcer/12.0/installation/disable_windows_rules.md:31 — Dale: passive-voice	'to be accepted' has no clearly identified actor (Windows vs. PPE), so an active rewrite risks stating the wrong one
docs/passwordpolicyenforcer/12.0/admin/administration_overview.md:11 — Dale: xy-slop	'Unlike password cracking products that ..., PPE ...' is a comparison, not the 'x is not y, x is z' negative-positive form
docs/passwordpolicyenforcer/12.0/admin/manage-policies/messages.md:33 — Dale: positional-references	'below it' describes the physical layout of the product UI, not the position of other documentation content
docs/passwordpolicyenforcer/12.0/web-overview/editing_html_templates.md:143 — Dale: positional-references	'above or below the {/ERROR/} line' describes where to insert text within a template file, not a documentation cross-reference
docs/passwordpolicyenforcer/12.0/admin/hibpupdater.md:122 — Dale: positional-references	'The preceding path' is the recommended sequential alternative to 'the above path', not a spatial direction word

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Auto-Fix Summary

15 issues fixed, 25 skipped across 77 files

Category	Fixes
Contractions	2
TypeVsEnter (rewrite)	1
Dale: passive-voice	6
Dale: undefined-acronyms	6

Skipped (needs manual review)	Reason
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdstartppehibpupdater.md:31 — Netwrix.FirstPerson	False positive — the flagged "I" is the PowerShell parameter alias in "Can also use -I or -i", not first person. Rewriting would break the documented cmdlet syntax.
docs/passwordpolicyenforcer/12.0/admin/hibpupdater.md:9 — Netwrix.FirstPerson	False positive — the "I" is part of the third-party product name "Have I Been Pwned (HIBP)", a proper noun that cannot be reworded.
docs/passwordpolicyenforcer/12.0/admin/manage-policies/rules/compromised_rule.md:13 — Netwrix.FirstPerson	False positive — the "I" is part of the linked third-party service name "Have I Been Pwned", a proper noun that cannot be reworded.
docs/passwordpolicyenforcer/12.0/admin/manage-policies/rules/rules.md:40 — Netwrix.FirstPerson	False positive — the "I" is a table cell in the character-substitution table listing the letters "I i" and their substitutes. Editing it would corrupt the reference data.
docs/passwordpolicyenforcer/12.0/web-overview/installationweb.md:31 — Netwrix.FirstPerson	False positive — the "I" is inside the verbatim installer UI label "I accept the terms of the license agreement". UI strings must match the product exactly.
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdconnectppe.md:37 — Dale: passive-voice	Literal PowerShell console output in the EXAMPLE section ('Connection to PPE was established'); rewriting would misrepresent what the product actually prints.
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdcopyppepolicy.md:36 — Dale: passive-voice	Literal console output ('The "User Policy" policy was created based on the "Eval Policy".').
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdexportppeconfig.md:31 — Dale: passive-voice	Literal console output ('Configuration export has been successfully completed...').
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdexportppepolicy.md:41 — Dale: passive-voice	Literal console output ('Configuration export has been successfully completed...').
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdgetppeconfigreport.md:36 — Dale: passive-voice	Literal console output ('The report is created: ...').
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdgetppebulkpasswordtest.md:45 — Dale: passive-voice	Literal console output ('The report is created: ...').
docs/passwordpolicyenforcer/12.0/admin/compromisedpasswordcheck.md:60 — Dale: passive-voice	Sample report content reproducing the product's own wording ('Sending emails isn't possible due to the lack of an email address in the account.', 'Email has been sent').
docs/passwordpolicyenforcer/12.0/admin/compromisedpasswordcheck.md:44 — Dale: misplaced-modifiers	The modifier sits inside a literal UI control label ('Notify users whose passwords are compromised by email') and the trailing description is missing a connecting word; several readings are possible, so a fix could change meaning.
docs/passwordpolicyenforcer/12.0/admin/ppe_tool.md:73 — Dale: idioms	'Hope you know what are you doing' is the PPE Tool's literal warning output, quoted in the Message column.
docs/passwordpolicyenforcer/12.0/admin/troubleshooting.md:78 — Dale: passive-voice	heading text — not modified to avoid breaking anchor links
docs/passwordpolicyenforcer/12.0/web-overview/editing_html_templates.md:109 — Dale: positional-references	Literal HTML template content shipped with the product (' Enter your old and new passwords in the text boxes below. '); editing it would make the documented sample differ from the real file.
docs/passwordpolicyenforcer/12.0/web-overview/editing_html_templates.md:143 — Dale: positional-references	'above or below the {/ERROR/} line' describes a literal position within a file the reader edits, not a cross-reference to other documentation.
docs/passwordpolicyenforcer/12.0/web-overview/editing_html_templates.md:115 — Dale: positional-references	'in a yellow box below the page instructions' describes on-screen UI layout, not a documentation cross-reference.
docs/passwordpolicyenforcer/12.0/web-overview/using_web.md:55 — Dale: positional-references	'in a yellow box below the page instructions' describes on-screen UI layout, not a documentation cross-reference.
docs/passwordpolicyenforcer/12.0/admin/manage-policies/messages.md:33 — Dale: positional-references	'a Preview below it' describes the physical arrangement of controls in the policy editor, not a documentation cross-reference. Same applies to line 57.
docs/passwordpolicyenforcer/12.0/admin/manage-policies/rules/character_rules.md:23 — Dale: positional-references	'The word Contain below the rule's name' locates a control in the user interface, not other documentation. Same applies to line 59.
docs/passwordpolicyenforcer/12.0/admin/manage-policies/rules/complexity_rule.md:13 — Dale: positional-references	'the number of character sets selected below it' refers to controls on the settings page, not documentation content.
docs/passwordpolicyenforcer/12.0/admin/hibpupdater.md:135 — Dale: wordiness	'automate the tool to retrieve and/or prepare the HIBP dataset' is wordy, but resolving 'and/or' would decide whether the two actions are independent — a meaning change I can't confirm.
docs/passwordpolicyenforcer/12.0/evaluation/testing_the_password_policy.md:73 — Dale: wordiness	'In fact' looks like filler, but it carries the contrast with the preceding sentence's 'change domain passwords'; removing it weakens the distinction the paragraph is drawing.
docs/passwordpolicyenforcer/12.0/admin/manage-policies/testpolicy.md:25 — Dale: wordiness	'As you type, Password Policy Enforcer evaluates...' is repeated at line 27, but merging the two would move text between a numbered step and the following explanatory paragraph, changing the procedure's structure.

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Documentation PR Review

This PR stands up the full PPE 12.0 doc set (77 new pages) and promotes it to default. Most pages carry over cleanly from 11.2. The findings below cluster into three groups: (1) cmdlet reference pages where the SYNTAX blocks are malformed or contradict their own PARAMETERS lists, (2) version-stale content carried over from 11.2 into a 12.0 doc set, and (3) individual clarity and completeness gaps. Since 12.0 is now the default version every reader lands on, the version-stale items are the highest-value fixes.

Editorial Review

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdconnectppe.md

• Clarity — Line 30–31: The about_CommonParameters link is duplicated back to back, so the sentence renders as "See [about_CommonParameters][about_CommonParameters]." Suggested fix: delete line 31 and add the closing period to line 30, matching every other cmdlet page in this folder.

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdcopyppepolicy.md

• Consistency — Line 9: The description names the cmdlet CopyPPEPolicy, but the page title, heading, SYNTAX, and example all use Copy-PPEPolicy. A reader searching the page for the cmdlet name finds a form that doesn't exist. Suggested fix: "The Copy-PPEPolicy cmdlet makes a copy of a Password Policy Enforcer (PPE) policy."

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdexportppepolicy.md

• Clarity — Line 9: Missing the word "cmdlet" — "The Export-PPEPolicy exports a Password Policy Enforcer policy to a file." Every other page in the folder uses the pattern "The X cmdlet s...". Suggested fix: "The Export-PPEPolicy cmdlet exports a Password Policy Enforcer policy to a file."
• Completeness — Line 25: "Name of the to export." is missing its noun, so the -PolicyName parameter has no usable description. Suggested fix: "Name of the policy to export."

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdgetppeconfigreport.md

• Completeness — Line 18: The SYNTAX line omits [<_CommonParameters_>] even though the PARAMETERS section documents common parameter support. A reader copying the syntax won't know common parameters are accepted. Suggested fix: "Get-PPEConfigReport-Folder`<_string_>` [`<_CommonParameters_>`]".

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdgetppepasswordtest.md

• Correctness — Lines 13 and 22: SYNTAX declares -Username, but the PARAMETERS section documents -User and the example runs -User PPETestUser. A reader following SYNTAX gets a parameter-binding error. Suggested fix: pick the real parameter name and use it in all three places.

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdgetppeserverversion.md

• Correctness — Line 13: The SYNTAX has unbalanced brackets ([__-DC__] <_string_>]) and omits -Local entirely, even though PARAMETERS documents -Local on line 22. Suggested fix: "Get-PPEServerVersion [[-DC] `<_string_>`] [[-Local] `<_SwitchParameter_>`] [`<_CommonParameters_>`]" — or drop the -Local entry from PARAMETERS if the cmdlet doesn't accept it.

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdimportppeconfig.md

• Correctness — Line 19: Stray brackets make the syntax uncopyable — **-File**] has a closing bracket with no opener, and `<_CommonParameters_>`] is missing its opening bracket. Suggested fix: "Import-PPEConfig-File`<_string_>` [`<_CommonParameters_>`]".

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdimportppepolicy.md

• Correctness — Line 19: **-File**] carries a stray closing bracket. Suggested fix: "Import-PPEPolicy-File`<_string_>` [`<_CommonParameters_>`]".

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdremoveppepolicy.md

• Correctness — Line 13: **-PolicyName**] carries a stray closing bracket. Suggested fix: "Remove-PPEPolicy-PolicyName`<_string_>` [`<_CommonParameters_>`]".

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdsetppedefaultpolicy.md

• Correctness — Line 13: **-PolicyName**] carries a stray closing bracket. Suggested fix: "Set-PPEDefaultPolicy-PolicyName`<_string_>` [`<_CommonParameters_>`]".

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdsetppeenabled.md

• Correctness — Line 13: **-Enable**] carries a stray closing bracket. Suggested fix: "Set-PPEEnabled-Enable`<_int_>` [`<_CommonParameters_>`]".

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdsetppepolicyenabled.md

• Correctness — Lines 14–15: The SYNTAX block is corrupted by stray escaped underscores and unmatched markers — **Set-PPEPolicyEnabled\_\_**-PolicyName** ... **-Enable\__] / `<\_int_>` — and won't render as valid syntax. Suggested fix: "Set-PPEPolicyEnabled-PolicyName`<_string_>`-Enable`<_int_>` [`<_CommonParameters_>`]".
• Clarity — Line 25: "specify 0 to dis -Poliable the policy" contains a paste artifact mid-word. Suggested fix: "Specify 1 to enable the policy, specify 0 to disable the policy."

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdstartppehibpupdater.md

• Clarity — Line 30: Missing space in "incrementalto add new entries". The description also describes -Inc as taking the values full or incremental, but SYNTAX declares it a <_SwitchParameter_>, which takes no value. Suggested fix: add the space, and reword to match the switch behavior — for example, "Include this switch to add only new entries to the existing database. Omit it to rebuild the entire database."
• Correctness — Lines 24 and 33: -Folder says "Can also use -D or -d" and -File says "Can also use -S or -s". Neither alias matches its parameter's initial letter, unlike every other cmdlet page in this folder. Verify these against the shipped module and correct them.
• Completeness — Line 45: The example path is missing its closing quotation mark, and the example has no output line, unlike every other cmdlet page. Suggested fix: close the quote and add the expected console output.

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdlets.md

• Clarity — Line 9: "manage Password Policy Enforcer from a Windows PowerShell" — the article makes PowerShell read like a countable object. Same issue on line 16 ("Open a Windows PowerShell"). Suggested fix: "manage Password Policy Enforcer from Windows PowerShell" and "Open Windows PowerShell."

docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdgetppelicenseinfo.md

• Clarity — Lines 26–63: Alternating lines of the sample license output are wrapped in **, which renders literal asterisks inside the fenced code block. The bolding appears to be an artifact of the source conversion rather than intentional emphasis. Suggested fix: remove the ** markers from the code block contents. The same alternating-bold pattern appears in cmdgetppepolicies.md (lines 24–30) and in the single-line outputs of cmdgetppedefaultpolicy.md, cmdgetppeenabled.md, cmdgetppepolicyenabled.md, cmdgetppeserverversion.md, cmdgetppeversion.md, cmdremoveppepolicy.md, cmdsetppedefaultpolicy.md, cmdsetppeenabled.md, and cmdsetppepolicyenabled.md — worth a single pass across the folder.

docs/passwordpolicyenforcer/12.0/admin/administration_overview.md

• Clarity — Line 16: "The Evaluate Password Policy Enforcer contains step-by-step instructions" reads as a sentence fragment because the link text is an imperative title, not a noun. The same sentence then calls the destination "the Evaluation Guide", a third name for the same page. Suggested fix: "The Evaluate Password Policy Enforcer guide contains step-by-step instructions to help you install, configure, and evaluate Password Policy Enforcer. Consider using this guide if you are using Password Policy Enforcer for the first time, before installing and deploying on your domains."

docs/passwordpolicyenforcer/12.0/admin/hibpupdater.md

• Clarity — Line 9: "Have I Been Pwnd (HIBP)" misspells the service name, which is "Have I Been Pwned". This is the acronym's first-use expansion, so the error propagates. Suggested fix: "Have I Been Pwned (HIBP)".
• Clarity — Line 28: "(Aproximetly 13GB but subject to change)" has two misspellings and a bare parenthetical. Suggested fix: "The HIBP database takes up additional space — approximately 13 GB, subject to change — on the machine where you copy it."
• Structure — Lines 36–37: The bullet "Requires a working network connection ... with Read permissions to check:" ends in a colon, but the content it introduces is a sibling bullet rather than a nested one, so the two read as unrelated items. Suggested fix: nest line 37 under line 36, or merge them into one sentence: "Requires a working network connection with Read permissions from the domain controllers to the network share. Checking the pending password candidate against the HIBP database over the network can affect LSASS and password-change performance, depending on the environment."

docs/passwordpolicyenforcer/12.0/admin/compromisedpasswordcheck.md

• Clarity — Lines 36 and 39: Two bullets carry the identical label Force users to change password, one for compromised passwords and one for reused passwords. A reader scanning the option list can't tell which UI control is which. Suggested fix: if the interface really shows the same label twice, disambiguate in the description — for example, "Force users to change password (under Compromised Passwords)" and "Force users to change password (under Password reuse)".

docs/passwordpolicyenforcer/12.0/admin/troubleshooting.md

• Structure — Line 12: This paragraph describes a distinct symptom (PPE applying one user's policy to everyone) but sits directly under the page intro with no heading, while every other symptom on the page gets a #### heading. Readers scanning the headings will miss it entirely. Suggested fix: add a heading such as "#### Password Policy Enforcer enforces the same policy for all users" above line 12.
• Structure — Lines 7 and 16: The page jumps from # straight to ####, skipping H2 and H3. Netwrix standards require never skipping heading levels. Suggested fix: promote all five #### symptom headings to ##.

docs/passwordpolicyenforcer/12.0/admin/password-policy-client/configuring_the_password_policy_client.md

• Correctness — Lines 32 and 35: The Windows policy definitions folder is C:\Windows\PolicyDefinitions (one word), not C:\Windows\Policy Definitions. A reader following these steps won't find the folder. Suggested fix: correct both paths to C:\Windows\PolicyDefinitions and C:\Windows\PolicyDefinitions\en-US.
• Completeness — Line 39: "If not, see the topic's section for additional information" points nowhere — there's no named section or link. Suggested fix: link to the specific procedure, or state it inline: "If not, follow steps 6 and 7 to create one."

docs/passwordpolicyenforcer/12.0/admin/manage-policies/testpolicy.md

• Structure — Line 75: The first bullet under Policy Testing vs. Password Changes is the lead-in sentence for the list ("...A password change may yield different results to a policy test because:"), formatted as a peer of the reasons it introduces. Suggested fix: unbullet line 75 and make it the paragraph that introduces the list.

docs/passwordpolicyenforcer/12.0/installation/domain_and_local_policies.md

• Correctness — Lines 32 and 46: Both reference the Password Policy Enforcer 11.0 registry key by name in a 12.0 doc set. A reader on 12.0 expanding HKEY_LOCAL_MACHINE > SOFTWARE > ANIXIS won't find an 11.0 item. Suggested fix: update to the 12.0 key name, or use a version placeholder consistent with configconsole.md, which writes it as Password Policy Enforcer <version>.

docs/passwordpolicyenforcer/12.0/evaluation/preparing_the_computer.md

• Correctness — Line 26: "gmpc.msc" transposes two letters; the Group Policy Management Console is gpmc.msc. It's spelled correctly in disable_windows_rules.md and installationgpm.md. Suggested fix: "gpmc.msc".
• Clarity — Line 48: "Step 6 – Double-click the Group Policy Management Editor." doesn't describe an action a reader can take — you don't double-click an editor — and Step 7 then closes it. Suggested fix: delete Step 6 and renumber, or state the intended action (for example, "Double-click Minimum password age and repeat step 4").
• Correctness — Line 52: gpupdate/target:computer is missing the space before the switch, so the command fails as written. Suggested fix: gpupdate /target:computer.

docs/passwordpolicyenforcer/12.0/evaluation/configuring_policy_rules.md

• Structure — Line 47: "Password must contain at least one uppercase character." is missing the "Requirement:" prefix that labels the other four requirements (lines 22, 33, 61, 71), so it reads as a stray statement rather than the start of a new section. Suggested fix: "Requirement: Password must contain at least one uppercase character."
• Clarity — Lines 47–57: This requirement is handled with the Characters (Granular) rule, but Step 5 of the preceding Complexity section (line 45) already told the reader to select Upper Alpha (A-Z) "now for the next requirement". The reader has now configured the uppercase requirement twice, in two different rules, with no explanation of why both are needed. Suggested fix: either drop the forward-reference in the Complexity section, or add a sentence explaining that the granular rule enforces the uppercase character specifically while the complexity rule counts character-set variety.
• Clarity — Line 81: Missing space in "selectDict.txt". Suggested fix: "...folder and select Dict.txt."

docs/passwordpolicyenforcer/12.0/evaluation/creating-a-password-policy/creating_a_password_policy.md

• Clarity — Line 34: Unbalanced parenthesis leaves the sentence unfinished — "Click the context menu (beside the policy name and select Make default." Suggested fix: "Click the context menu beside the policy name, then select Make default."

docs/passwordpolicyenforcer/12.0/evaluation/enforcing_multiple_policies.md

• Correctness — Line 34: The text refers to "the Administrators policy" and "the Users policy", but the policies the reader created in this guide are named Admins Policy (Step 2, line 21) and Eval Policy (created in creating_a_password_policy.md). Readers looking for those names in the console won't find them. Suggested fix: "...must now comply with the Admins Policy. All other users must comply with the Eval Policy."

docs/passwordpolicyenforcer/12.0/evaluation/testing_the_password_policy.md

• Correctness — Line 132: The link labeled "Netwrix support" points to mailto:support@anixis.com, the pre-acquisition ANIXIS address. Other pages in this set use https://www.netwrix.com/support.html. Suggested fix: "Contact Netwrix Support if Password Policy Enforcer isn't working as expected."

docs/passwordpolicyenforcer/12.0/web-overview/installationweb.md

• Completeness — Lines 9 and 14: This page documents installing PPE Web V7.11 and links a 7.11 download, but web_overview.md (line 12) links PasswordPolicyEnforcer-Web-10.3.0.1.msi. A reader who follows the overview downloads 10.3 and then reads a 7.11 install procedure. Suggested fix: reconcile the two pages on one supported PPE Web version, and update the download link, wizard executable name (line 22, PPEWeb711.exe), and the compatibility note on line 67 to match.
• Clarity — Line 55: "You must back up and customized HTML templates and images before upgrading" — "and" should be "any". Suggested fix: "You must back up any customized HTML templates and images before upgrading."

docs/passwordpolicyenforcer/12.0/web-overview/securing_web.md

• Clarity — Line 27: Missing "to" — "The IIS documentation explains how request, install, and use SSL certificates." Suggested fix: "The IIS documentation explains how to request, install, and use SSL certificates."

docs/passwordpolicyenforcer/12.0/web-overview/web_overview.md

• Clarity — Line 30: Typo — "Separate the web server from he internal network". Suggested fix: "Separate the web server from the internal network for extra security."

docs/passwordpolicyenforcer/12.0/web-overview/editing_html_templates.md

• Structure — Line 11: The page opens with ### User Interface Files directly under the # title, skipping H2, and line 48 then drops to #### before the first ## appears at line 71. Netwrix standards require never skipping heading levels. Suggested fix: promote line 11 to ## User Interface Files and line 48 to ### Resource Strings.

docs/passwordpolicyenforcer/12.0/index.md

• No issues found.

docs/passwordpolicyenforcer/12.0/admin/configconsole.md

• No issues found.

docs/passwordpolicyenforcer/12.0/admin/settings.md

• No issues found.

docs/passwordpolicyenforcer/12.0/admin/systemaudit.md

• No issues found.

docs/passwordpolicyenforcer/12.0/admin/writeback.md

• No issues found.

docs/passwordpolicyenforcer/12.0/admin/ppe_tool.md

• No issues found.

docs/passwordpolicyenforcer/12.0/admin/manage-policies/manage_policies.md, messages.md, passphrases.md, policy_properties.md, usersgroups.md

• No issues found.

docs/passwordpolicyenforcer/12.0/admin/manage-policies/rules/ (character_rules, complexity_rule, compromised_rule, dictionary_rule, history_rule, length_rule, maximum_age_rule, minimum_age_rule, patterns, repetition, rules, similarity_rule, unique_characters)

• No issues found.

docs/passwordpolicyenforcer/12.0/admin/password-policy-client/password_policy_client.md

• No issues found.

docs/passwordpolicyenforcer/12.0/evaluation/conclusion.md, evaluation_overview.md, improving_the_password_policy.md, installforeval.md, creating-a-password-policy/policy_templates.md

• No issues found.

docs/passwordpolicyenforcer/12.0/installation/disable_windows_rules.md, installationclient.md, installationgpm.md, installationserver.md, upgrading.md

• No issues found.

docs/passwordpolicyenforcer/12.0/web-overview/configuration.md, using_web.md

• No issues found.

docs/passwordpolicyenforcer/12.0/admin/cmdlets/ (cmdexportppeconfig, cmdgetppebulkpasswordtest, cmdgetppedefaultpolicy, cmdgetppeenabled, cmdgetppehelp, cmdgetppepolicies, cmdgetppepolicyenabled, cmdgetppeversion, cmdstartppecompromisedpasswordchecker)

• No issues beyond the shared example-output bolding noted under cmdgetppelicenseinfo.md.

docs/passwordpolicyenforcer/11.2/admin/hibpupdater.md

• No issues found. The %SystemRoot% fragment removal is correct.

Summary

38 editorial suggestions across 26 files. The highest-priority items are the malformed cmdlet SYNTAX blocks (cmdsetppepolicyenabled.md, cmdimportppeconfig.md, cmdgetppepasswordtest.md, cmdgetppeserverversion.md), which give readers commands that fail as written, and the version-stale carryovers now surfacing as default content: the Password Policy Enforcer 11.0 registry key in domain_and_local_policies.md, the ANIXIS support address in testing_the_password_policy.md, and the PPE Web 7.11 vs. 10.3 mismatch between installationweb.md and web_overview.md. Vale and Dale issues are auto-fixed separately.

---

What to do next:

Comment @claude on this PR followed by your instructions to get help:

• @claude fix all issues — fix all editorial issues
• @claude help improve the flow of this document — get writing assistance
• @claude explain the voice issues — understand why something was flagged

You can ask Claude anything about the review or about Netwrix writing standards.

Automated fixes are only available for branches in this repository, not forks.

[github-actions]

Auto-Fix Summary

6 issues fixed, 22 skipped across 78 files

Category	Fixes
Dale: misplaced-modifiers	1
Dale: passive-voice	3
Dale: wordiness	2

Skipped (needs manual review)	Reason
docs/passwordpolicyenforcer/11.2/admin/hibpupdater.md:9 — Netwrix.FirstPerson	False positive — the 'I' is part of the third-party product name 'Have I Been Pwnd (HIBP)'. Rewriting would corrupt a proper noun.
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdstartppehibpupdater.md:9 — Netwrix.FirstPerson	False positive — the 'I' is part of the third-party product name 'Have I Been Pwned (HIBP)'. Rewriting would corrupt a proper noun.
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdstartppehibpupdater.md:31 — Netwrix.FirstPerson	False positive — the 'I' is the PowerShell parameter alias '-I' for the -Inc switch, not first person.
docs/passwordpolicyenforcer/12.0/admin/hibpupdater.md:9 — Netwrix.FirstPerson	False positive — the 'I' is part of the third-party product name 'Have I Been Pwnd (HIBP)'. Rewriting would corrupt a proper noun.
docs/passwordpolicyenforcer/12.0/admin/manage-policies/rules/compromised_rule.md:13 — Netwrix.FirstPerson	False positive — the 'I' is part of the linked service name 'Have I Been Pwned'. Rewriting would corrupt a proper noun and the link text.
docs/passwordpolicyenforcer/12.0/admin/manage-policies/rules/rules.md:40 — Netwrix.FirstPerson	False positive — the 'I' is a table cell in the character-substitution table listing the letters I and i, not first person.
docs/passwordpolicyenforcer/12.0/web-overview/installationweb.md:31 — Netwrix.FirstPerson	False positive — the 'I' is inside the verbatim UI label 'I accept the terms of the license agreement'. Changing it would misquote the installer control.
docs/passwordpolicyenforcer/12.0/admin/troubleshooting.md:78 — Dale: passive-voice	heading text — not modified to avoid breaking anchor links
docs/passwordpolicyenforcer/12.0/admin/compromisedpasswordcheck.md:44 — Dale: misplaced-modifiers	"Notify users whose passwords are compromised by email" reads as compromised by email, but this is the literal product UI option label; changing it would misstate the interface
docs/passwordpolicyenforcer/12.0/admin/hibpupdater.md:36 — Dale: misplaced-modifiers	"a working network connection from the Domain Controllers to the Network Share with Read permissions" — unclear whether Read permissions attach to the share or the connection; also present verbatim in the 11.2 file. Multiple valid readings, so the author's meaning can't be preserved with confidence
docs/passwordpolicyenforcer/11.2/admin/hibpupdater.md:37 — Dale: misplaced-modifiers	same ambiguous "with Read permissions" attachment as the 12.0 file
docs/passwordpolicyenforcer/12.0/admin/settings.md:29 — Dale: passive-voice	The bulleted condition list ("PPE is disabled", "The policy ... is disabled", "No policy is assigned to a user", "... isn't selected") is uniformly stative. Converting only some bullets to active voice would break the parallel structure, and converting all of them would rewrite content beyond the violation
docs/passwordpolicyenforcer/12.0/admin/compromisedpasswordcheck.md:25 — Dale: passive-voice	"The Password Scanner is disabled by default" is standard technical-writing phrasing for a default state; an active rewrite would need an actor the source doesn't name
docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdconnectppe.md:37 — Dale: passive-voice	"Connection to PPE was established" is literal PowerShell console output in an EXAMPLE block, not prose (same applies to the console-output lines in cmdcopyppepolicy.md, cmdexportppeconfig.md, cmdexportppepolicy.md, and cmdgetppeconfigreport.md)
docs/passwordpolicyenforcer/12.0/admin/ppe_tool.md:73 — Dale: idioms	"Hope you know what are you doing" is verbatim PPE Tool output reproduced in the Message column, not documentation prose
docs/passwordpolicyenforcer/12.0/admin/compromisedpasswordcheck.md:54 — Dale: positional-references	"Here is an example of the compromised passwords report:" is not a spatial direction word; the style guide's directional-language rule targets "above", "below", "on the right", which this doesn't use
docs/passwordpolicyenforcer/12.0/admin/manage-policies/messages.md:33 — Dale: positional-references	"a Preview below it" describes the actual physical layout of the product UI, not a reference to other content in the document (same for character_rules.md:23, messages.md:45 and :57, using_web.md:55, editing_html_templates.md:93 and :115)
docs/passwordpolicyenforcer/12.0/admin/manage-policies/policy_properties.md:28 — Dale: positional-references	"All characters above ANSI 126" uses "above" to mean numerically greater, not a document position
docs/passwordpolicyenforcer/12.0/admin/hibpupdater.md:37 — Dale: undefined-acronyms	LSASS is a standard Windows component that the domain-controller admin audience for this page would recognize
docs/passwordpolicyenforcer/12.0/admin/manage-policies/rules/maximum_age_rule.md:35 — Dale: undefined-acronyms	PDC emulator is well-known Active Directory terminology for this audience
docs/passwordpolicyenforcer/12.0/admin/manage-policies/messages.md:11 — Dale: undefined-acronyms	"PPE Configuration Console" appears in a link label four lines before Password Policy Enforcer (PPE) is spelled out in body prose; too marginal to restructure the procedure step (same pattern in policy_properties.md:11)
docs/passwordpolicyenforcer/12.0/evaluation/testing_the_password_policy.md:73 — Dale: xy-slop	"these consoles reset passwords rather than change them" is a single-clause contrast that carries a real technical distinction, not the "x is not y, x is z" padding pattern

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Code Review

Scope: correctness, build/routing, scripts, workflows. Documentation content and style are handled by the separate doc-review workflow.

No blocking correctness bugs found. One thing to confirm is intentional, plus a couple of minor notes.

Confirm intentional: every screenshot is dropped from 12.0 while 11.2 is hidden

docs/passwordpolicyenforcer/12.0/ contains zero image references, versus 123 across 47 files in 11.2/. Prose was rewritten to describe what the screenshots showed (e.g. admin/manage-policies/testpolicy.md, and admin/manage-policies/usersgroups.md, where the policy-selection flowchart image was replaced with a Mermaid diagram — a nice improvement). There is also no static/images/passwordpolicyenforcer/12.0/ directory, so this is self-consistent, not a broken-image situation.

The thing to weigh is the combination with the products.js change: 12.0 becomes isLatest/defaultVersionand11.2 flips to hidden: true in the same commit. VersionSwitcher filters hidden versions and renders nothing when one or fewer remain (src/components/VersionSwitcher/index.js:40,50), so the default PPE docs will be entirely image-free with no in-page path to the 11.2 pages that still have the screenshots. (Strictly, the switcher already rendered nothing — 11.1/11.0/10.2 were already hidden — so this is not a switcher regression, just the net reader-facing effect.)

If 12.0 UI screenshots are coming in a follow-up, this is fine as a scaffold. If not, consider keeping 11.2 visible until 12.0 has images.

Minor: stale version strings carried into 12.0

Copied verbatim from 11.2 and not updated:

• docs/passwordpolicyenforcer/12.0/installation/domain_and_local_policies.md:32 and :46 — the Password Policy Enforcer 11.0 registry key path and the Password Policy Enforcer 11.0 UI item.
• docs/passwordpolicyenforcer/12.0/admin/cmdlets/cmdgetppelicenseinfo.md:36 — sample output shows Version: 11.

These now ship as the default version docs. Flagging as version-scaffolding completeness rather than prose.

Verified clean

• src/config/products.js — exactly one isLatest: true for the product, defaultVersion of 12.0 matches it, and hidden is an already-supported flag (products.js:1049, VersionSwitcher/index.js:40) that affects homepage/switcher listing only. 11.2 and older still build and stay linkable.
• Sidebar — sidebars/passwordpolicyenforcer/12.0.js exists at the path products.js points to and is identical in shape to 11.2.js (autogenerated, dirName of .).
• Tree parity — the 12.0 file list is identical to 11.2 (same 90 paths), and all six _category_.json files are unchanged copies, so category link.id targets and position ordering carry over intact.
• Links — every relative and /docs/...md link in 12.0 resolves to a file that exists; the two genuinely new relative links (rules/complexity_rule.md, ../policy_properties.md) are valid. No 11.2 / 11_2 leftovers anywhere in 12.0.
• Anchors — all 46 fragment links in 12.0 map to real headings, including the rewritten ones (policy-testing-vs-password-changes, policy-selection-flowchart, detecting-character-substitution). Relevant given onBrokenAnchors: throw.
• KB link rewrites — dropping the version segment (/docs/passwordpolicyenforcer/11_2/admin/... to /docs/passwordpolicyenforcer/admin/...) is correct: createRedirects in docusaurus.config.js:207-217 emits an unversioned alias for every latest-version page, so those URLs now follow the default version automatically. Both link targets exist in 12.0. The pathname:// variants bypass build-time checking but land on the same generated aliases.
• KB copy pipeline — no change needed. buildConfig() in scripts/copy-kb-to-versions.mjs:43-93 derives versions straight from PRODUCTS, and .gitignore:23 already covers 12.0/kb. kb_allowlist.json is generated, not committed.
• MDX safety — the only curly braces and raw tags in 12.0 are inside fenced code blocks or intentional JSX style props in rules.md; the new Mermaid block in usersgroups.md is properly fenced and Mermaid is enabled site-wide.
• No workflow, script, or secret changes in this PR. Nothing touching CI triggers, permissions, or credentials.

Note: the build check was still running when this review was written, so the full Docusaurus build has not yet confirmed the link/anchor analysis above.

[hilram7]

Ran local product build tests and confirmed all links redirected.

The Docusaurus-specific protocol 'pathname:///docs/...' only populated from npm run build and not npm run start. KB reference-link formatting standards may need updating to prevent false errors.