1

I have set up a new Windows Server 2008 R2 domain controller, and have attempted to configure the Default Domain Policy to permit all types of passwords. When I want to create a new user (just a normal user) in the Domain Users and Computers application, I am prevented from doing so because of password complexity/length reasons.

The password policy options configured in the Default Domain Policy are not defined in the Default Domain Controllers Policy, but having run the Group Policy Modelling Wizard these settings do not appear to be set for the Domain Controllers OU, should they not be inherited from the Default Domain policy? Additionally, if I link the Default Domain policy to the Domain Controllers OU, the Group Policy Modelling Wizard indicates the expected values for complexity etc, but I still cannot create a new user with my desired password. The domain is running at the Windows Server 2008 R2 functional level. Any thoughts?

Thanks!

Update: Here is the "Account policy/Password policy" Section from the GPM Wizard:

Policy                           Value                     Winning GPO    
Enforce password history         0 Passwords Remembered    Default Domain Policy
Maximum password age             0 days                    Default Domain Policy
Minimum password age             0 days                    Default Domain Policy
Minimum password length          0 characters              Default Domain Policy
Passwords must meet complexity   Disabled                  Default Domain Policy

These results were taken from running the GPM Wizard at the Domain Controllers OU. I have typed them out by hand as the system I am working on is standalone, this is why the table is not exactly the wording from the Wizard. Are there any other policies that could override the above? Thanks!

1
  • Please provide the results section relavent to passwords from the modeling wizard. Anything else would be speculation.
    – keltor
    Mar 16, 2012 at 15:40

3 Answers 3

1

windows 2008 introduced the Password Settings Objects (PSO) for more granular control of the password policy. You might have case of conflicting PSO.

http://technet.microsoft.com/en-us/library/cc770848(v=ws.10).aspx

3
  • Thanks for your answer, but as I haven't been able to create new users I cannot check if there is a custom PSO for that user. I checked the administrator account (the only account I have on the domain) and there is no PSO defined, but I cannot even change the password for this account.
    – Earl Sven
    Mar 20, 2012 at 9:50
  • looking at policy is one thing, but they are set on Domain object so you can verify them there.
    – KAPes
    Mar 21, 2012 at 19:28
  • looking at policy is one thing, but they are set on Domain object so you can verify them there. dsquery.exe * -scope base -attr minpwdage maxpwdage minpwdlength pwdHistoryLength should list actual values for password history, min/max length etc there. Are they matching with what is configured in Default domain policy? if not do you have "block policy inheritance" enabled on "Domain Controllers" OU?
    – KAPes
    Mar 22, 2012 at 4:09
0

If you use the Group Policy Mgmt tool, highlight the domain, right-click and select Group Policy Modeling Wizard. Run through it to the end. Once the results are displayed, look at the password settings. This should tell you whether the settings are as you say they are.

One possible issue is that your replication isn't working correctly in the Domain.

1
  • Thanks for your answer, the settings are as expected at both the Domain level and the Domain Controllers level. Is there a way I can view the password requirements for new users?
    – Earl Sven
    Mar 20, 2012 at 9:48
0

it's a guess (without RSOP) but ensure that the minimum password length is set to 0

1
  • Thanks for your answer, I've relaxed all of the policies on passwords on the Default Domain Policy object, if I run the Group Policy Modelling Wizard on the Domain Controllers OU this indicates the policy to be as expected, however I still cannot create new users in the Users object in AD Users and Computers.
    – Earl Sven
    Mar 20, 2012 at 9:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .