Re: Password Policy

From: Steven L Umbach (n9rou_at_nscomcast.net)
Date: 05/17/04

  • Next message: Steven L Umbach: "Re: unable to change password" 
    Date: Mon, 17 May 2004 20:59:30 GMT

    Password and account policy for domain users can only be created at the
    domain level and will be ingnored at all other levels for domain users.
    Think of it as having a built in no override. What you experiencing is
    probably due to the fact that that when you implement a maximum password age
    policy, it does not reset a domain users password age and some if not most
    users will have to change their passwords well before the 90 day maximum. If
    you run "net user username" on a domain controller you will see when a users
    password was last changed. --- Steve

    "Chad Guiney" <anonymous@discussions.microsoft.com> wrote in message
    news:0E5BCD3B-CB61-4422-BADF-BF3A2449AB9F@microsoft.com...
    > I have created a new group policy that makes users change their passowrd
    every 90 days. I have created the policy on an OU that contains just
    internal staff in active directory. I have noticed that passowrds were
    changing earlier than 90 days. Is it possible that the default domain
    password policy is the one in effect and not the one I created on the
    Internal Users OU? I thought I heard that passwords can only be set at the
    domain level is that true? If not what could I be doing wrong that my users
    are being prompted to change their passwords before the 90 day period?
    >
    > Thanks
    > Chad

  • Next message: Steven L Umbach: "Re: unable to change password"

    Relevant Pages

    • Re: Domain
      ... Domain Controller Security Policy has all user rights assignments ... Configuring ipsec policy at the domain level ...
      (microsoft.public.win2000.group_policy)
    • Re: Security hierarchy
      ... policy level also. ... >>can be configured only at domain level. ... Try running security configuration and ... >>try not to change domain and domain controller policy, ...
      (microsoft.public.win2000.security)
    • Re: Login Scripts
      ... Default Domain Policy) that contains the "baseline" settings that users ... at the OU level will override settings declared at the domain level, and GPO ... > domain if no MSI package is found. ...
      (microsoft.public.windows.server.active_directory)
    • Re: Account Lockout Threshold change - Not taking effect
      ... The other policy is linked at the domain level. ... I even changed the settings to 5 attempt. ... Have you tried unlinking the additional GPO you've created at the Domain ...
      (microsoft.public.windows.server.active_directory)
    • Re: Security hierarchy
      ... OK - last night I managed to reset the password policy. ... I had to boot into DS restore mode in order to be able to access the ... New users had to have complex passwords. ... >> I have tried all the suggestions plus a new top GPO at domain level ...
      (microsoft.public.win2000.security)
    Loading