Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have one user in my AD domain who seems to not be able to self-select a password. I may have another one, but they're on a different enough password-expiration schedule that I can't remember who it is right now.

I can set a password via ADU&C just fine, but when he tries it via C-A-D he gets the "doesn't meet complexity" message. Figuring he was just doing something like 'pAssword32', I did some troubleshooting of my own and sure enough it doesn't want to take a password that way.

He's one of our users that habitually uses a local account and then maps drives using his AD credentials so he doesn't get the your password will expire in 4 days, maybe you should change it prompts, so he's a frequent "my password expired, can you fix it" flyer.

I don't want to keep having him set it via ADU&C over my shoulder every N days. I'm just fine setting temp passwords of 48 characters of keyboard-slamming and letting him change it something memorable.

My environment is at the Windows 2008 R2 functional level, and I am using fine-grained password policies. In fact, I have two such policies:

  1. For normal users (minimum length, remembered passwords)
  2. For special utility accounts

The password complexities I've tried match both policies for length and char-set selection.

The permissions on the User object themselves look normal, SELF does indeed have the "Change Password" right.

Is there some other place I should be looking for things that can affect this?

share|improve this question
5  
this is problem #1 "He's one of our users that habitually uses a local account" how did this local account get created? And why is he allowed to use it? –  tony roth Nov 27 '12 at 16:09
    
@tonyroth Don't get me started on our Mac users, and the two Linux-heads. They're just as bad, but don't have this problem. This is why I'm writing a "your password is about to expire, you should change it" auto-mailer script. –  Blue Warrior NFB Nov 27 '12 at 16:12
1  
also if he's logged in locally and doing a cad then he's changing his pw of his local account that he shouldn't have, notthe domain account. –  tony roth Nov 27 '12 at 16:12
    
lol now I understand! forget all my comments and just give up if you need to support mac's. –  tony roth Nov 27 '12 at 16:13
    
Look for consecutive characters in both the password and user name or description field. With my frequent "reset my password, ZOMG!!!!1" lusers, I wait an additional day for every past request they've put in. As motivation. –  HopelessN00b Nov 27 '12 at 16:14
show 9 more comments

1 Answer

up vote 3 down vote accepted

It turns out I was insufficiently observant, overly paranoid, or perhaps a bit... BOFHy when I set the fine-grained password policies. Looking closely at them (ADSI edit is not a great interface for that, too much other stuff) I noticed that I am setting a minimum password age.

Apparently, admin-resets do indeed reset this aging timer to zero.

Apparently, Windows reports the password-complexity error when it is too soon to reset a password.

Unless I want to change it, my "reset me!" users will have to put up with (for example) 2 days of the impossible-to-remember-but-very-long-password dunce-cap before they can set it to something they can remember.

Maybe this is just the hammer I need to urge them into straight up domain accounts.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.