Active Directory Group Policy Question (Password Policy)

Question

I have a Default Domain Policy on Server 2003 with a minimum of 8 characters required for passwords and complexity check.

Now I created a new OU and placed myself as the user in that OU and also my computer in that OU. Then I created a new group policy and linked it to that OU. The new GP has the minimum password restriction to 6. I ran gpupdate on the server and my computer and running gpresult does show the policy being applied to the computer.

But when I try to change my password it still requires 8 minimum characters on my password. I also checked the local policy of my computer and that has changed too to 6 minimum characters.

So why am I being still asked for 8?

Answer 1

That's because the password policy in AD 2003 trees is domain wide. For AD 2003, the password policy specified in the Default Domain Policy trumps any password policies set anywhere else. If it doesn't have one, no one does. You can't do OU-level changes in policy in a 2003 tree.

Microsoft introduced this ability with their "Fine Grained Password Policies" in AD 2008, and they're NOT set by GPO. It's a different system entirely.

Microsoft has a decent article about this here: http://technet.microsoft.com/en-us/magazine/2007.12.securitywatch.aspx

Answer 2

From this site -

That said, many administrators believe it's possible to have multiple password policies for users in the same domain. They think you can create a GPO and link it to an Organizational Unit (OU). The idea is to move user accounts to the OU so that the GPO will affect the objects. Within the GPO, the Account Policies are modified to create a more secure Password Policy, perhaps by setting the maximum password length to 14 characters. But, for a several reasons, this configuration will never provide the desired outcome. First, the Password Policy settings are computer-based rather than user-based policies. With this foundation for the settings, they will never affect a user account. Second, the only way to modify the Account Policy settings for a domain user account is within a GPO linked to the domain. GPOs linked to the OU that are configured to alter the Account Policies settings will modify the local SAM of computers that reside in the OU, or are in sub-OUs of the linked OU.

Long story short, in a Windows 2003 domain you can have only a single password policy. Windows 2008 domains introduce fine-grained password policies that allow more than one.

Answer 3

Password policy applies only in one (1) place -> Domain Policy.