Apply a password group policy seperate from the Default Domain Policy?

Question

Im trying to keep my Default Domain Policy clean and standard and I want to make a GPO for my password policies.

I made it but it still gets the policies from the Default Domain Policy object.

I imagine that it gets that one because it is the most restrictive one but I would enjoy one that I can make a copy of the Default Domain Policy, edit that one, and then apply first that and if something isnt applied/changed/etc, apply the default in the Default Domain Policy.

Is it possible?

Answer 1

Your password policy can be in a group policy you create. There is nothing special about the 'default domain policy' that is created for you.

The Policy you should be applied at the root for the best results. By being linked there directly or inherited from the root, and not be blocked. Password policies are a computer policy and are enforced by the computer with the password database. In the case of your active directory this is your Domain Controllers.

It is likely that you already have password policy settings in existing policies (they are in a default install) So it will be important to make sure the Link order of this new policy is any other policy, though you probably should remove the password settings from any other policies to prevent confusion.

If you look at the Group Policy results for one of your domain controllers you should see what policy and settings are being applied and from what Policy Object if you run into problems.

---

Separate password policy

Policy Link order

Policy Results.

Answer 2

Password policies set on the Default Domain Policy always apply over and above any other password policy unless you're using FGPP somewhere down the line.

it's fine to have it at the root of the domain, that's where it should be.

If you want to apply a separate password policy then you need to set all the password settings in the Default Policy to "Not Set" and then create a new GPO (or use another pre-existing one) to apply the password settings at the same, or a different level.

Answer 3

Create password settings defined in Active Directory Administration Center > Select your Domain > Select the System Container > Select Password Settings Container > Select "New" > Select Password Settings.

Here you can apply policies based on individual groups or users that are separate than the domain policy.

Use precedence to manage multiple policies that may apply to the same group of users.

I hope this helps.

-Justin

Answer 4

First things first. The password policy is only relevant for authorities that change passwords. In an AD domain, this is the DC that owns the PDC emulator FSMO role. As a consequence, in a default environment there are only two spots where you can apply a password policy in theory:

1. The domain (root)
2. The OU "Domain Controllers" (directly below the domain root)

So if you apply a password policy on an OU that does not contain the PDC emulator somewhere, it can and will not have any effect. You will see the settings on a client though when viewing with secpol.msc, but they are meaningless. Only the settings that apply to the PDC emulator will count.

Now, there is something special about password policies. They are designed to apply to the whole domain. MS therefore does not support password policies that are applied to the "Domain Controllers" OU. So your only playground left is the domain. There you can indeed have a custom GPO that contains password policies. To win against the Default Domain Policy or other GPOs that contain password policies, you have two possibilities:

1. Enforce your custom GPO (assuming it will be the first enforced GPO on domain level)
2. Move your custom GPO above all other GPOs (containing password policies and assuming they are not enforced) concerning the link order. That means give it a smaller number. The GPOs are applied in reverse order, so the GPO with link order number 1 will be applied last and thus will win.

Answer 5

I tried to do in the past without success. Password policies have to apply in the Default Domain Policy to work.