Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm new to the Server administration game. I'm about to push out my first group policy concerning passwords.

I'm going to do something simple. Use MS's built in complexity requirements and an max age of 6 months or so.

Quick background. I'm the first person this company has had in their IT dept. I'm trying to get everything figured out and settled. It seems half or so of the users (about 150) have the "Password never expires" checked in active directory user properties.

If I use a group policy for passwords will the GP supersede the AD user properties settings?

If not. Do I just go through AD and uncheck that for all accounts I want to be forced to change their passwords?

Thanks in advance. Let me know if there's anymore info you need!

share|improve this question

2 Answers 2

up vote 9 down vote accepted

Enabling "Password never expires" will override any password expiration policy you configure in Group Policy.

But you can configure this setting much faster, without using dsa.msc. To list all user accounts with "Password never expires" set:

dsquery *  -filter "(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=65536))" -limit 0

To disable the setting for these users:

dsquery *  -filter "(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=65536))" -limit 0 | dsmod user -pwdneverexpires no
share|improve this answer
    
+1...a much better answer than mine :-) –  Jason Berg Jan 24 '11 at 21:32
    
Thank you. Exactly what I needed to know, and more. –  gtaylor85 Jan 24 '11 at 21:37

If "Password never expires" is set in AD, your group policy will not force them to change their passwords. Everything else in GP will apply to the accounts though.

Instead of unchecking everyone's account, you can do a bulk property edit by selecting multiple users (or all users) in an OU and editing the property once to state that passwords do expire.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.