Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a specific Organizational Unit in my Active Directory domain that needs to have weak password settings. I set up my GPO and created a new policy for the OU OU=Limited Users,OU=Production,OU=VetWeb,DC=vw,DC=local called "GPO for Limited Production Users". According to Group Policy Modeling I did set up everything correctly.

enter image description here

However when I try to create a new user or change the password on a existing user with a password that would not meet complexity requirements I get a error message. For example resetting the password for the user CN=Test,OU=Limited Users,OU=Production,OU=VetWeb,DC=vw,DC=local to the password of 12345 gives me the error that the new password does not meet the password complexity requirements.

enter image description here

Doing a gpupdate /force does not resolve the issue. What must I do to allow users in OU=Limited Users,OU=Production,OU=VetWeb,DC=vw,DC=local not to require complex passwords?

share|improve this question
up vote 8 down vote accepted

You can't set a password policy for an OU this way. The password policy for the entire domain is defined in the Default Domain Policy. It cannot be overridden at a per-OU level through Group Policy. What you want is a Fine Grained Password Policy, which is a bit more complicated to configure, but is the only way to accomplish what you want.

share|improve this answer
And just to add some detail to this answer, Fine Grained Password policies can't be applied to an OU. They're only applied to users directly or via groups that users are a member of. – Ryan Bolger May 30 '12 at 7:38
What can help with that is to use the concept of a shadow group, which mirrors the members of an OU. – SturdyErde May 30 '12 at 14:29
Shadow groups only mirror the members of an OU for as long as the domain admins are diligent about keeping them up to date. Sadly, there's no built-in way to automate this. – Ryan Bolger Jun 4 '12 at 21:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.