Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to assign strong requirement to a Active Directory domain group? In this case, the strong password would be 8 charters or longer, with at least one capital letter, one lower and one number. They also would need to change their password every 30 days.

Users outside of this group would have another password policy that isn't as tight.

We have an 2003 Active Directory domain.

Thank You for your help.

share|improve this question
up vote 6 down vote accepted

You get one password policy in a domain in Active Directory with Windows Server 2003. You'll have to make a child domain for the users who need a different password policy, or upgrade to Windows Server 2008.

Have a look here:

This has been a weakness of Active Directory for a long time, but it's only remidied in W2K8.

share|improve this answer
Correct; this setting can only be implemented for the entire domain. Incidentally, aside from the changing requirement, I wouldn't consider your proposed policy "strong". Password1 satisfies it, for example. – Le Comte du Merde-fou Jun 17 '09 at 18:26

I'm pretty sure that this setting is domain-wide, which means that you would need to establish another tree in your active directory forest. Probably not worth it unless there are other reasons to segregate those user accounts.

share|improve this answer

Windows Server 2008 Domain Controllers can address this issue now.

Here is a good article with some screenshots.

share|improve this answer

The best way to solve this problem in windows 2003 is to create a seperate domain. In Windows 2000 and Windows Server 2003, you can only have one password policy, account lockout policy and Kerberos authentication per domain. If you have a subset of users within your domain who absolutely require a different configuration for these items, they need to be configured with a separate domain. To configure a password policy for your domain, create a GPO and link it to your domain, or else modify an existing domain policy that's already in place. The other option is to upgrade to server 2008 AD DS which allows for Fine-Grained Password Policies.

share|improve this answer

Group policies are applied in the Site -> Domain -> Organizational Unit order. At whatever level you assign your default password policy make sure the "No Override" option is not checked. Then create an new Organization Unit to hold the user accounts you want the different password policy for and create a new group policy on that OU with your specific settings. Other policy settings will be inherited.

share|improve this answer
BZZT! This won't work for domain user accounts. You can do this for local accounts on member server computers, but domain accounts all get the single domain password policy, constructed as an amalgam of all password policies applied in GPOs at the root of the domain. (Now, why the password policies don't work this way in W2K8 is beyond me. The way that granular password policy was implemented in W2K8 makes no sense, but that's a different story...) – Evan Anderson Jun 17 '09 at 18:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.