up vote 3 down vote favorite
share [g+] share [fb]

I need to change the local security policy for a domain member server (not a domain controller). The settings such as "password must meet complexity requirements" are grayed out. They are grayed out if I am logged in as a domain administrator or local machine administrator. Both the Domain controller and member server are Windows Server2003.

How to find out why the choices are grayed out?

link|improve this question
feedback

1 Answer

up vote 3 down vote

All password policies are to be done on the Domain Security Policy and they are domain wide changes. You cannot exclude an OU, for example, from password enforcement policies.

link|improve this answer
to elaborate slightly: when a domain policy is specified, the local policy is overridden. – atk Aug 12 '09 at 19:20
1  
True for 2003, but finally MS have addressed this irritating limitation. In 2008 AD you can now define password policy by user, group, or OU (via shadow groups) – Izzy Aug 12 '09 at 19:22
1  
@Xeon: Not exactly true. You can have different password policies for member servers by applying GPOs only to those member servers. There can be only one password policy for domain controllers in a Windows 2000 or Windows 2003 Active Directory, but you definitely can have different password policies for local accounts on member servers. – Evan Anderson Aug 12 '09 at 19:51
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.