Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Greetings all,

We have an active directory domain which enforces a strict password policy. Hooray!

Now, for the project we are working on, we are going to be storing users of our website Microsoft's AD-LDS service as well as using that for authentication of our web users.

By default, it is my understanding that AD-LDS inherits its password policy from the domain of the machine it's installed on. Is there any way to break that link such that we can define a lighter password policy (or none if we so choose) for users in AD-LDS without affecting our domain?

Note: AD-LDS is going to be hosted on a machine which is part of the domain.

Thanks in advance.

share|improve this question
    
You didn't say which version of AD you were using? –  TechGuyTJ Dec 22 '10 at 3:45

3 Answers 3

up vote 4 down vote accepted

I bumped into this (old) question while looking for something else, but I will add an answer for anyone that ends up here actually looking for an answer...

An option you can use (assuming you have a least a 2008 level AD domain) is to apply a password policy with your required "lighter" settings specifically against the server(s) you have hosting ADLDS. While 2003 and below had only domain-wide password policy settings, 2008 and up can support fine-grained password policies configured against certain areas of the domain.

share|improve this answer

I'm not sure if this lets you still set up and enforce a lighter password policy, but you can ignore the domain password policies by using ADSI Edit to connect to the Configuration naming context on the LDAP server. Then , on the object CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,CN={guid}, there's a multi-valued attribute called msDS-Other-Settings. One of the attributes in that is ADAMDisablePasswordPolicies, which you can set to 1.

share|improve this answer

You need not go right up to Optional Settings.
Going right up to CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,CN={guid} is enough.
The attribute ADAMDisablePasswordPolicies has to be set to 1.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.