{"id":2298,"date":"2015-02-21T19:04:24","date_gmt":"2015-02-21T15:04:24","guid":{"rendered":"https:\/\/rakhesh.com\/?p=2298"},"modified":"2015-02-21T19:06:21","modified_gmt":"2015-02-21T15:06:21","slug":"ad-domain-password-policies","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/ad-domain-password-policies\/","title":{"rendered":"AD Domain Password policies"},"content":{"rendered":"

Password policies are set in the “Computer Configuration” section at Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy<\/code>.<\/p>\n

The policy applies to the computer as user objects are stored in the database of\u00a0the computer. A Domain Controller is a special computer in that its database holds user objects for the entire domain, so it takes its password policy settings from whatever policy wins at the domain level. What this means is that you can have multiple policies in a domain – each containing different password policies – but the only one that matters for domain users is the policy that wins at the domain level. Any policy that applies to OUs will only apply to local<\/em> user objects that reside in the SAM database of computers in that OU.\u00a0<\/p>\n

A quick recap on how GPO precedence works: OU linked GPOs override Domain linked GPOs which override Site linked GPOs which override local GPOs (i.e. OU > Domain > Site > local). Within each of these there can be multiple GPOs. The link order matters here. The GPOs with lower link order win over GPOs with higher link order (i.e. link order 1 > link order 2 > …). Of course all these precedence order can be subverted if a GPO is set as enforced<\/em>. In this case the parent GPO cannot be overridden by a child GPO.\u00a0<\/p>\n

By default the Default Domain Policy is set at the Domain level and has link order 1. If you want to change the password policy for the domain you can either modify this GPO, or create a new GPO and apply it at the Domain level (but remember to set it at a lower link order than the Default Domain Policy<\/em> – i.e. link order 1 for instance).\u00a0<\/p>\n

For a list of the password policy settings check out this<\/a> TechNet page.\u00a0<\/p>\n

Since Windows Server 2008 it is possible to have Fine Grained Password Policies (FGPP) that can apply to OUs. These are not GPOs, so you can’t set them via GPMC. For Server 2008 this TechNet page<\/a> has instructions (you have to use PowerShell or ADSI Edit), for Server 2012 check out this blog post<\/a>\u00a0(you can use ADAC; obviously Server 2012 makes it easier). Check out this article<\/a> too for Server 2008 (it is better than the TechNet\u00a0page which is … dense on details).\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

Password policies are set in the “Computer Configuration” section at Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy. The policy applies to the computer as user objects are stored in the database of\u00a0the computer. A Domain Controller is a special computer in that its database holds user objects for the entire domain, so it takes its password … Continue reading AD Domain Password policies<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[333,85],"tags":[4,45,468],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2298"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=2298"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2298\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=2298"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=2298"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=2298"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}