Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my 2003 domain, I am being requested to set a password policy to require passwords to expire every 4 months, and also require users to change their password on their next login, due to a security issue. In my domain, my OU's are setup by location, then drilled down to city, then the users and computers are in separate sub-domains.

My question is, how do I set this up for my domain? Will I need to set the policy up for loop back? Can I configure this for just a specific OU? Any suggestions on how to move forward? Any advise is much appreciated, and thanks in advance!

share|improve this question
With a 2003 domain, you may only have a single password policy for the enitre domain. Usually it is configured within the GPO "Default Domain Policy". – jscott Jun 25 '12 at 14:15
up vote 3 down vote accepted

To configure the password policy, you should edit the Default Domain Policy for each domain that you want to change this on. This is where the password policy is set.

To make users change passwords at their next logon, you can select all, right click, and select Properties from ADUC and put a check in the box that makes users change passwords at next logon, or you can script it in any number of languages, like batch, PowerShell, or VBscript.

share|improve this answer
Is there any way that I can configure this policy now, but keep it inactive?? I'm waiting for management to make a final decision on the exact password policy, but I want to be able to deploy this quickly after the decision is made. – Jake A Jun 25 '12 at 14:24
No. There isn't. – MDMarra Jun 25 '12 at 14:24
Is there a way to configure this only for a specific OU?? – Jake A Jun 25 '12 at 14:45
No, there is not. You can only configure it per-domain. There are more options when you have a 2008 level domain (fine-grained password policies); but even then you cannot configure password policies per domain. – HostBits Jun 25 '12 at 14:47
Not via GPO. You'd need to use a FGPP, which isn't available in a 2003 domain. A FGPP allows you to apply a different password policy to a group, so you would just put everyone from the OU in question into a group. That said, it's a moot point, since you're on 2003. – MDMarra Jun 25 '12 at 14:47

You will need to configure the password settings in a group policy object linked at the domain level. This will more than likely be the "default domain policy" if you are running a default type setup. In the GPMC right click the policy and choose "edit...". Expand out Windows Settings > Security Settings > Account Policies > Password Policy. To force users to change their password every 4 months; edit the Maximum Password Age and set it to 120 days.

To force users to change their password at next logon; you can use the methods MDMarra suggests.

share|improve this answer
Thanks Cheekaleak! – Jake A Jun 25 '12 at 14:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.