Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I found this article: AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide really useful to set fine-grained password policies for a user or a Security Group.

But I haven't found any way to do this at an OU level - at least not any way that I can get it to work.

Any good articles that show how to do this?

share|improve this question
2  
Did you miss this statement in that article? PSOs cannot be applied to organizational units (OUs) directly. –  Zoredache Jun 28 '12 at 19:37
    
Me bad. I dived right in to Step 1! –  nzpcmad Jun 28 '12 at 19:50
add comment

1 Answer

You cannot apply FGPP to an OU directly.

http://technet.microsoft.com/en-us/library/cc770394(WS.10).aspx

Fine-grained password policy cannot be applied to an organizational unit (OU) directly. To apply fine-grained password policy to users of an OU, you can use a shadow group.

A shadow group is a global security group that is logically mapped to an OU to enforce a fine-grained password policy. You add users of the OU as members of the newly created shadow group and then apply the fine-grained password policy to this shadow group. You can create additional shadow groups for other OUs as needed. If you move a user from one OU to another, you must update the membership of the corresponding shadow groups.

share|improve this answer
2  
Yep. Make a group. Put everyone in the OU that you want to target in that group. Done. –  MDMarra Jun 28 '12 at 19:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.