Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Situation is this:

I need to have a particular container in my AD environment which blocks password expiry policy, but accepts all other policies. Is this something that would work by simply adding in a GPO at the sub-ou level (the ou in question is a child of ou's where GPO's including password stuff is set).

These accounts (and this ou) already exist and will have the default domain policy as well as other policies applied and they should continue to receive policy settings as per those GPO's, with the exception of the Password Expiry.

We have tried the password do not expire tickbox and that seems not to have worked.

Thanks in advance.


share|improve this question
are you sure you are after "password expiry" because "password never expires" bit on users is specifically created for that. You might have to ask affected user to logoff from all possible applications/workstations/servers before it becomes effective. – KAPes Feb 15 '10 at 23:03
up vote 5 down vote accepted

You don't mention whether you're working with a Windows 2003 Active Directory or a Windows 2008 Active Directory.

In a Windows 2003 Active Directory all domain user accounts are subject to the resultant account policy from GPOs applied at the root of the domain. You can't have some accounts with different password policies (expiry, length, lockout settings, etc). (Local user accounts on non-domain controller computers can have different password policies, but domain users all fall under the same domain password policy).

In Windows 2008 Active Directory, when set to a Windows 2008 functional level, you can have "granular" password policies. Microsoft didn't implement this with Group Policy, though. Rather, a new type of Active Directory object is used. Here's an article re: granular password policy to get you started, if you can use them:

If you're stuck at Windows 2003 Active Directory the only method to have different password policies for a subset of users is to create another domain and put the accounts in that domain.

share|improve this answer
We have AD 2003. Thanks for confirming this for me. – Kip Oct 2 '09 at 8:56

What version of Windows server are you running? If you don't have 2008 or your domain is not at the 2008 functional level it simply isn't possible.

Here is an article about Fine-Grained Password Policies.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.