Password Policy on AD

[Mal]

Hi guys, gals and mum.

I am trying to figure out how the Password Policy gets
applied to domain user accounts.

The Password Policy is set in the Computer section of the
GPO, how does that then apply the policy to domain
accounts?

My main problem is trying to selectively apply a password
policy to different user groups and ou's.

Obviously, if I try to apply a policy in a GPO and then
apply this GPO to an OU or Security Group then it does
not get applied as the computer policy is only applied to
computers (As I remember it, the Computer Policy is
applied before the computer is logged on, the User Policy
is applied after the computer is logged on).

Where am I going wrong? It feels like it should be so
simple and the lightbulb will instantly flash on any
minute!!

My current thinking is that if I apply a password policy
to the domain controllers this will set the policy onto
all accounts created, which is not what I want.

Any suggestions, assistance, ideas will help!!! I'll get
the hair dye out tomorrow and complete the Blonde moment!

Mal

 

[Don Wilwol \(CollTech\)]

http://support.microsoft.com/default.aspx?scid=kb;en-us;269236
http://support.microsoft.com/default.aspx?scid=kb;en-us;221930

Password policies can only be set at the domain level.

dw

 

[Matjaz Ladava [MVP]]

Password policies are domain wide and thus set at domain GPO. If you need
different password policies, you need multiple domain. If you set password
policy in GPO at OU level, that policy is applied to local security policy
on related computer and thus affecting local accounts.

--
Regards

Matjaz Ladava, MCSE, MCSA, MCT, MVP
Microsoft MVP - Active Directory
(e-mail address removed), (e-mail address removed)
http://ladava.com

 

[Joe Richards [MVP]]

As indicated, these policies are domain wide only for domain user ids and the reason they are in the computer section
because the policy is applied to domain controllers which set specific values in the directory on the domain's default
partition object.