Strong password requirements for a group of users

Question

Is it possible to assign strong requirement to a Active Directory domain group? In this case, the strong password would be 8 charters or longer, with at least one capital letter, one lower and one number. They also would need to change their password every 30 days.

Users outside of this group would have another password policy that isn't as tight.

We have an 2003 Active Directory domain.

Thank You for your help.

Answer 1

You get one password policy in a domain in Active Directory with Windows Server 2003. You'll have to make a child domain for the users who need a different password policy, or upgrade to Windows Server 2008.

Have a look here: http://technet.microsoft.com/en-us/library/cc770394.aspx

This has been a weakness of Active Directory for a long time, but it's only remidied in W2K8.

Answer 2

I'm pretty sure that this setting is domain-wide, which means that you would need to establish another tree in your active directory forest. Probably not worth it unless there are other reasons to segregate those user accounts.

Answer 3

Windows Server 2008 Domain Controllers can address this issue now.

Here is a good article with some screenshots.

http://capitalhead.com/articles/step-by-step-guide-to-fine-grained-passwords-in-windows-server-2008.aspx

Answer 4

The best way to solve this problem in windows 2003 is to create a seperate domain. In Windows 2000 and Windows Server 2003, you can only have one password policy, account lockout policy and Kerberos authentication per domain. If you have a subset of users within your domain who absolutely require a different configuration for these items, they need to be configured with a separate domain. To configure a password policy for your domain, create a GPO and link it to your domain, or else modify an existing domain policy that's already in place. The other option is to upgrade to server 2008 AD DS which allows for Fine-Grained Password Policies.

Answer 5

Group policies are applied in the Site -> Domain -> Organizational Unit order. At whatever level you assign your default password policy make sure the "No Override" option is not checked. Then create an new Organization Unit to hold the user accounts you want the different password policy for and create a new group policy on that OU with your specific settings. Other policy settings will be inherited.