Setting Password Policy on Machine that is Part of a Domain

Question

Windows Server 2003.

I need my host to change a password policy (required password length) on a machine that is part of their domain. I only need the change to apply to machine accounts.

They claim it is not possible without affecting the entire domain. I know it is possible because I have had it done at other hosts.

What are the steps to do this?

Answer 1

A user password policy cannot be set without affecting the entire Domain, but certain computer password policy settings are also available under Computer Config | Windows Settings | Security Settings | Local Policies | Security Options. I've never really needed to change these, so I can't confirm or deny that they can be changed at OU (or even local) level, but i'm guessing that your host may be confusing the two.

Answer 2

It is possible, but probably not practical from their point of view. Or perhaps they are just clueless.

I assume that their domain-wide policy has been applied in the Default Domain Policy GPO, or another GPO linked to the domain. The problem, at least from their point of view, is that this will override any local policies which you or they define on your machine's local policies.

Group Policy objects are processed in the following order:

• Local policies
• Domain GPOs linked to the AD site which the machine is in
• Domain GPOs linked to the domain which the machine is a member of
• Domain GPOs linked to OU the machine is in

Each successive policy setting overwrites the previously applied setting/s which conflict, i.e. local policies on password length, etc. will always be irrelevant because the domain policy is applied after local policy and hence overwrites it.

The only way you can have what you want is if they were willing to put your machine into its own OU and then create a new GPO containing the password policies you want. This GPO would be linked to the OU containing your machine.

See this TechNet article for more detail.

Answer 3

If user is domain account then policy set at Domain level GPO applies and no exception. (This changes in Windows 2008 with new Password Settings Objects)

If you want to change password policy for local accounts on some servers then it is possible.

In our case we mandate that all local accounts created on server should have 15 character password (to stop AD from storing there LM hashes), while all domain accounts have 10 character passwords.

You can do that using creating group policy with appropriate password policy changes and linking it to OU where all machine accounts are located.