A technician wants to improve password security after several users admitted to using very simple passwords. Which of the following is the best way to resolve this issue?

Requiring four character types is good for complexity but increasing length is often a more impactful first step to prevent 'simple' passwords.

Decreasing password expiration times does not inherently make passwords stronger; users might simply cycle through weak passwords more frequently.

Enabling an automatic lock timer is a security measure for unattended systems but does not directly improve the strength or complexity of the passwords themselves.

Increasing the minimum password length directly improves password security by making passwords harder to guess or crack through brute-force attacks. Adding two characters significantly increases the number of possible combinations, making even simple character sets result in much stronger passwords, thereby addressing the issue of users using 'very simple passwords.' This directly enhances complexity and strength.