A fine grained password policy with msDS-MaximumPasswordAge set to 2 days asks for reset immediately on Server 2008R2.
After I apply the policy, in the next automatic gpupdate, the machine starts asking for new credentials.
asked Mar 14, 2016 at 20:22
-
And what is the age of the password?– Greg AskewMar 14, 2016 at 20:35
-
The password was changed long before that timespan.– Francisco Fernandez CecchettoMar 16, 2016 at 16:35
-
When you set that policy, you effectively expired the password of any account in scope that had a password age over two days.– Greg AskewMar 18, 2016 at 0:05
Add a comment
|
1 Answer
As Greg hinted at in his comment, the maximum password age is always calculated based on the age of the password in question.
So for example, let's say you have a policy set to 30 days and your password is currently 15 days old. Everything works normally. Then you change your policy to 2 days. But your password is still 15 days old, so it is immediately considered expired.
answered Mar 14, 2016 at 22:37
-
That's what I supposed but couldn´t confirm. Thanks a lot Mar 16, 2016 at 16:37