Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found this article: AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide really useful to set fine-grained password policies for a user or a Security Group.

But I haven't found any way to do this at an OU level - at least not any way that I can get it to work.

Any good articles that show how to do this?

share|improve this question
Did you miss this statement in that article? PSOs cannot be applied to organizational units (OUs) directly. – Zoredache Jun 28 '12 at 19:37
Me bad. I dived right in to Step 1! – nzpcmad Jun 28 '12 at 19:50

You cannot apply FGPP to an OU directly.

Fine-grained password policy cannot be applied to an organizational unit (OU) directly. To apply fine-grained password policy to users of an OU, you can use a shadow group.

A shadow group is a global security group that is logically mapped to an OU to enforce a fine-grained password policy. You add users of the OU as members of the newly created shadow group and then apply the fine-grained password policy to this shadow group. You can create additional shadow groups for other OUs as needed. If you move a user from one OU to another, you must update the membership of the corresponding shadow groups.

share|improve this answer
Yep. Make a group. Put everyone in the OU that you want to target in that group. Done. – MDMarra Jun 28 '12 at 19:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.