0

In my 2003 domain, I am being requested to set a password policy to require passwords to expire every 4 months, and also require users to change their password on their next login, due to a security issue. In my domain, my OU's are setup by location, then drilled down to city, then the users and computers are in separate sub-domains.

My question is, how do I set this up for my domain? Will I need to set the policy up for loop back? Can I configure this for just a specific OU? Any suggestions on how to move forward? Any advise is much appreciated, and thanks in advance!

1
  • With a 2003 domain, you may only have a single password policy for the enitre domain. Usually it is configured within the GPO "Default Domain Policy".
    – jscott
    Jun 25, 2012 at 14:15

2 Answers 2

3

To configure the password policy, you should edit the Default Domain Policy for each domain that you want to change this on. This is where the password policy is set.

To make users change passwords at their next logon, you can select all, right click, and select Properties from ADUC and put a check in the box that makes users change passwords at next logon, or you can script it in any number of languages, like batch, PowerShell, or VBscript.

5
  • Is there any way that I can configure this policy now, but keep it inactive?? I'm waiting for management to make a final decision on the exact password policy, but I want to be able to deploy this quickly after the decision is made.
    – Jake A
    Jun 25, 2012 at 14:24
  • No. There isn't.
    – MDMarra
    Jun 25, 2012 at 14:24
  • Is there a way to configure this only for a specific OU??
    – Jake A
    Jun 25, 2012 at 14:45
  • No, there is not. You can only configure it per-domain. There are more options when you have a 2008 level domain (fine-grained password policies); but even then you cannot configure password policies per domain.
    – HostBits
    Jun 25, 2012 at 14:47
  • Not via GPO. You'd need to use a FGPP, which isn't available in a 2003 domain. A FGPP allows you to apply a different password policy to a group, so you would just put everyone from the OU in question into a group. That said, it's a moot point, since you're on 2003.
    – MDMarra
    Jun 25, 2012 at 14:47
3

You will need to configure the password settings in a group policy object linked at the domain level. This will more than likely be the "default domain policy" if you are running a default type setup. In the GPMC right click the policy and choose "edit...". Expand out Windows Settings > Security Settings > Account Policies > Password Policy. To force users to change their password every 4 months; edit the Maximum Password Age and set it to 120 days.

To force users to change their password at next logon; you can use the methods MDMarra suggests.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .