Password Policy

[Guest]

I have created a new group policy that makes users change their passowrd every 90 days. I have created the policy on an OU that contains just internal staff in active directory. I have noticed that passowrds were changing earlier than 90 days. Is it possible that the default domain password policy is the one in effect and not the one I created on the Internal Users OU? I thought I heard that passwords can only be set at the domain level is that true? If not what could I be doing wrong that my users are being prompted to change their passwords before the 90 day period

Thank
Chad

 

[rbs74]

Yes password settings are domain wide---meanign you can only have one
setting per domain.....and these are determined by the policies attached
to the domain object.

 

[Steven L Umbach]

Password and account policy for domain users can only be created at the
domain level and will be ingnored at all other levels for domain users.
Think of it as having a built in no override. What you experiencing is
probably due to the fact that that when you implement a maximum password age
policy, it does not reset a domain users password age and some if not most
users will have to change their passwords well before the 90 day maximum. If
you run "net user username" on a domain controller you will see when a users
password was last changed. --- Steve

I have created a new group policy that makes users change their passowrd

every 90 days. I have created the policy on an OU that contains just
internal staff in active directory. I have noticed that passowrds were
changing earlier than 90 days. Is it possible that the default domain
password policy is the one in effect and not the one I created on the
Internal Users OU? I thought I heard that passwords can only be set at the
domain level is that true? If not what could I be doing wrong that my users
are being prompted to change their passwords before the 90 day period?