Password Changes - URGENT

[Gil]

hi,
I want to change my users passwords policy. I want to change for example the
minimun passowrd length .
I have 300 users and I do NOT want to change the policy for all the users at
the same time.
But if I will use the domain security policy for this change, it will change
the policy for all the users at the same time.
I saw in the win2000server GPO the option to change the passowrd policy from
the computer configuration of the GPO and NOT from the user configuration of
the GPO.
1. How can I change the password policy from the GPO from the USER
CONFIGURATION and NOT from the COMPUTER CONFIGURATION.

2.I have only winn2000server and NONE win2003 server. So I will NOT be able
to apply the GPO option for changing the password policy for PART of the
users in the OU !!! (I have 300 users and I do NOT want to change the policy
for all the users at the same time.)
How can I solve this issue without installing win2003 server or installing
third party tool for this issue ???

thanks alot.

 

[Simon Geary]

You are out of luck I'm afraid. The password length policy is a domain wide
setting and can only be defined at the domain level. It is not possible to
have more than one password length policy in the same domain. Your only
option to have different users with differing password policies would be to
have them in separate domains.

Upgrading to Windows 2003 or installing 3rd party tools will not help in
this scenario. You would need to install a second domain in the forest and
then migrate users into the new domain. The new domain could then have a
different password policy from the existing one although this would require
a lot of work and planning and is not something I would recommend you do
just to fix this one problem. What's the reason for requiring such a policy
change, maybe there are other ways around it?

 

[Dave Shaw [MVP - Directory Services]]

Actually, you *aren't* completely out of luck. However, the solution will
require purchasing some 3rd-party software to install on your DCs.

http://www.anixis.com/products/ppe/

http://www.altusnet.com/passfilt/

Both these products allow the creation of multiple password policies within
the same domain. For you, that would mean that you could impliment your new
policy a global group at-a-time.

-ds

 

[Lanwench [MVP - Exchange]]

hi,
I want to change my users passwords policy. I want to change for
example the minimun passowrd length .
I have 300 users and I do NOT want to change the policy for all the
users at the same time.
But if I will use the domain security policy for this change, it will
change the policy for all the users at the same time.
I saw in the win2000server GPO the option to change the passowrd
policy from the computer configuration of the GPO and NOT from the
user configuration of the GPO.
1. How can I change the password policy from the GPO from the USER
CONFIGURATION and NOT from the COMPUTER CONFIGURATION.

2.I have only winn2000server and NONE win2003 server. So I will NOT
be able to apply the GPO option for changing the password policy for
PART of the users in the OU !!! (I have 300 users and I do NOT want
to change the policy for all the users at the same time.)
How can I solve this issue without installing win2003 server or
installing third party tool for this issue ???

thanks alot.

Perhaps OT, but why don't you want to change the policy so it applies to all
at once? It won't force them to change their passwords or invalidate their
current ones, IIRC - it will only apply after they have a forced password
change or manually change their passwords.

 

[Shalom B.]

You could enforce this kind of a policy change with a work around that
could be messy but if properly thought out and implemented might just
work sm.

Create a temporary group on your domain and create and apply a GPO (with
the necessary changes) to this group, then slowly add users to this
group, when all 300 users are done, you could then apply the GPO to your
old group(s) and delete the temporary group.

 

[Joe Richards [MVP]]

This will not work. Password policy for domain users is domain wide.

joe