Re: Group Policy - Maximum Password Age


"Florian Frommherz [MVP]" <florian@xxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:Ol5cDrVAJHA.1588@xxxxxxxxxxxxxxxxxxxxxxx
Howdie!

Flash3200 wrote:
OK, this is weird.... In Group Policy we have the Default Domain set
to Disabled. However, even though it is set to Disabled it does have
settings in it from when it use to be Enabled. One of the settings is
that the Maximum Password Age is set to 90 Days. Ok, now in the Group
Policy we have set and enabled on the OU for where my user's and
computers reside we have the Maximum Password Age set to 45 Days. Now
this is where it gets weird... even though everything I look at (GP
Modeling, GP Results, etc) says that the Maximum Password Age is set
to 45 Days, it appears that the passwords do not expire until they
reach 90 Days?

Domain Password settings can only be made at the domain level, not at OU
level. The settings you linked at the OU will reflect on the local
accounts that each machine in the target of the policy has. Have a look at
the domain level ... apart from the disabled Default Domain Policy - is
there another Group Policy that defines password settings?

cheers,

Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
Maillist (german): http://frickelsoft.net/cms/index.php?page=mailingliste

Also, the last valid policy applied (on the domain) is still the policy.
Disabling the GPO doesn't change it. You need a new policy with a GPO on the
domain to override the old.

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--


.

Relevant Pages

  • Re: WMP Wont Set Up; Wizard Wont Move
    ... The first picture shows you found the right policy but set it to Disabled ... See http://zachd.com/pss/pss.html for some helpful WMP info. ... Configuration>Admin Templates>All Settings or User Configuration>All ... Use and disabling it but it had no impact. ...
    (microsoft.public.windowsmedia.player)
  • Re: Disable password policy
    ... oops, you are searching for disabling the "Link enabled" option, not ... the "domain"-password policy is storeed in the default domain policy. ... configure these settings instead of disabling the whole policy. ...
    (microsoft.public.windows.server.sbs)
  • Re: Disable Remember My Password
    ... "Do not allow AutoComplete to save passwords" ... Also check the 'Disable the Content page' policy. ... and change these settings. ... | disabling the 'Remember My Password' check box. ...
    (microsoft.public.windowsxp.general)
  • Re: No policy for specified computer?
    ... settings to the new OU and at the properties of new OU at Group Policy ... tab select disable Policy inheritance so that no policy will be applied to ... Disabling policy inheritance is not a general solution but should be ...
    (microsoft.public.windows.server.general)
  • New Password Policy to implement
    ... Implement a new settings based on our new company Policy: ... Maximum password age =0 ...
    (microsoft.public.win2000.active_directory)