Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to change the local security policy for a domain member server (not a domain controller). The settings such as "password must meet complexity requirements" are grayed out. They are grayed out if I am logged in as a domain administrator or local machine administrator. Both the Domain controller and member server are Windows Server2003.

How to find out why the choices are grayed out?

share|improve this question

All password policies are to be done on the Domain Security Policy and they are domain wide changes. You cannot exclude an OU, for example, from password enforcement policies.

share|improve this answer
to elaborate slightly: when a domain policy is specified, the local policy is overridden. – atk Aug 12 '09 at 19:20
True for 2003, but finally MS have addressed this irritating limitation. In 2008 AD you can now define password policy by user, group, or OU (via shadow groups) – Izzy Aug 12 '09 at 19:22
@Xeon: Not exactly true. You can have different password policies for member servers by applying GPOs only to those member servers. There can be only one password policy for domain controllers in a Windows 2000 or Windows 2003 Active Directory, but you definitely can have different password policies for local accounts on member servers. – Evan Anderson Aug 12 '09 at 19:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.