diff --git a/manifests/login.pp b/manifests/login.pp
index 6fe6c9d3..5f253572 100644
--- a/manifests/login.pp
+++ b/manifests/login.pp
@@ -63,6 +63,10 @@
 
   validate_re($login_type,['^(SQL_LOGIN|WINDOWS_LOGIN)$'])
 
+  if $check_expiration and !$check_policy {
+    fail ('Can not have check expiration enabled when check_policy is disabled')
+  }
+
   $create_delete = $ensure ? {
     present => 'create',
     absent  => 'delete',
diff --git a/spec/defines/login_spec.rb b/spec/defines/login_spec.rb
index 3e7b9d88..5aad545c 100644
--- a/spec/defines/login_spec.rb
+++ b/spec/defines/login_spec.rb
@@ -35,4 +35,9 @@
     it_behaves_like 'mssql_tsql command'
     it_behaves_like 'mssql_tsql onlyif'
   end
+  describe 'check_policy' do
+    let(:additional_params) { {:check_policy => false, :check_expiration => true} }
+    let(:raise_error_check) { 'Can not have check expiration enabled when check_policy is disabled' }
+    it_should_behave_like 'validation error'
+  end
 end