Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How can I remove the minimum password length for a specified user in an OU? (I do not want the default domain password policy affecting my GPO.)

When the "minimum password length" in my default domain GPO is not configure, things work like I want, but if I configure the minimum password length, it applies to my GPO, which I don't want.

The OU in question has users, "ali" and "reza." I want Ali to get the default domain policy and Reza to get my GPO.

How do I do it so that Reza doesn't get the password policy in the domain default GPO, but Ali does?

share|improve this question
possible duplicate of Strong password requirements for a group of users – EliadTech Jan 21 at 14:45

1 Answer 1

up vote 5 down vote accepted

What you're talking about is a feature called "fine-grained password policies", and requires a domain functional level of Server 2008 or higher.

There's a nice, easy step-by-step instruction guide on enabling and using fine-grained password policies on the Technet blogs, if you'd like to take a look, but it's not all that complicated. The thing that trips most people up is trying to do this with simple GPO inheritance and OU structure, without enabling the feature (or not having the required domain functional level to use the feature).

The basics of it, though, are that you enable the feature, use a PSO (Password Settings Container) with the password settings you want, and apply that PSO to Reza.

share|improve this answer
i how do this with simple GPO inheritance and OU structure, without enabling the feature ? – ehsan Jan 21 at 14:47
@ehsan you can't, FGPP was added to specifically address the need for multiple password policies. – Jim B Jan 21 at 14:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.