Password expiration

[Jerry Morgan]

I've been trying to get a better understanding of password
expirations with Active Directory. From what I read, you
need to set the policy setting in the domain policy under
Computer Configuration/Windows Settings/Security
Settings/Account Polices/Password Policy. If I want to
have different policies I could modify the policy for an
OU that is under the domain. Lets say I have a user (User
A) and he is part of an OU (OU 1) that has a password
policy set to expire passwords after 90 days. He changes
his password after being prompted. If he is a roaming user
who uses different PC's in the organization, what will
happen if he goes to another computer that is not part of
OU 1 but gets it's policy from the domain security policy
that is set to 30 days. Will he be prompted to change his
password after 30 days when using that computer? I guess
what I'm asking is, is there a way to set password
policies per users (or a group of users) rather then per
computer.

 

[Danny Sanders]

In Win 2k account policies are 1 to a domain. Setting a password policy on
an OU will ONLY take affect when the user logs on locally to the computer
contained in the OU. Logging on to the domain from same computer with a
password policy applied at OU level will enact the domain Account policy.
See:
http://support.microsoft.com/default.aspx?scid=kb;en-us;255550&Product=win2000


With Win 2k differing account policies is one reason to have a separate
domain.

hth
DDS W 2k MVP MCSE