2

I have just made a new Windows Server 2012 R2 domain. Joined the PC and user to the domain and everything Works on that end.

Now I made a group policy (that is being checked as being pushed with rsop.msc on the client PC) that allows them to put any password they want.

The problem is that the clients (via Ctrl+Alt+Del) cannot change their password. It gives them the error message of

Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain.

I've gone also to the "Default Domain Policy" and tried to change it there (even though rsop.msc says that the GPO being applied is the one I made) and it still does not allow them to change it.

I also joined a fresh machine and a new user, and it still does not apply. I have it set to apply to all authenticated users. Do I need to change something else?

A few other things:

The OU (Computers) that my GPO is linked to is all computers. My OU is "Company Name" and inside of it there are two other OUs One is "Users" and the other is "Computers". I am only linking it to Computers.

gpresult /r is telling me that the policy is being applied to the computer.

I am doing gpupdate /force on both server and client side (should not be neccesary for client)

1
  • "Now I made a group policy (that is being checked as being pushed with rsop.msc on the client PC) that allows them to put any password they want." Well that is a grade-A hilariously bad idea.
    – Ryan Ries
    Apr 19, 2016 at 2:22

4 Answers 4

3

There can be only one password policy per domain and it MUST be linked to the domain. A password policy linked to an OU will have no effect. The GPO may show as being processed but the settings will not be implemented. - http://blogs.technet.com/b/askpfeplat/archive/2013/01/14/fun-and-games-active-directory-password-policies.aspx

2
  • 1
    This is correct, but I just want to add one little extra bit - a password policy linked to an OU will have a subtle effect - it will change the password policy of local accounts on the computers within the management scope of that GPO -- but yes, only one domain password policy per domain. (Excluding FGPPs.)
    – Ryan Ries
    Apr 19, 2016 at 2:23
  • Right, because a Password Policy affects the local user account database, which for member servers is the local SAM, thus affecting local user accounts on member computers. For Domain Controllers it's the AD database (Ntds.dit), thus affecting all domain user accounts.
    – joeqwerty
    Apr 19, 2016 at 2:33
3

Check the GPO inheritance on your Domain Controllers OU or run an RSOP on one of your DCs. You may have a GPO that contains password policy settings with higher precedence on your DCs than your Default Domain Policy. If so, that's also overriding the password policy you set in your Default Domain Policy.

As joeqwerty said, there can be only one "default" password policy for domain users. And that policy is controlled by whatever settings get applied to the domain controllers, not the member server where users might be changing their domain password from.

Password policy settings that get applied to member computers only affect passwords for local accounts on that member.

3

You can find your Password Policies using this comment:

net accounts /domain

Try changing the Local Policy of the system.

Use this command to open Local Security Policy:

secpol.msc
0

The password MUST BE composed of at least :

  • one CAPITAL letter
  • one number
  • one normal letter
  • 8 characters length.

If not, the password will not be correct. Try it and give your feedback.

4
  • I have a policy that overwrites that BUT on top of that and just in case, I do make a password with those points and still it does not let me change it. The user is admin of his own PC. Its very strange. My question is directed towards if there is any additional policy that limits this.
    – riahc3
    Mar 12, 2015 at 10:38
  • I contacted someone else and he did indeed inform me that there are NO additional policies that stop by default a user changing his password. So it must be something on my end....Will try to get screenshots ASAP.
    – riahc3
    Mar 12, 2015 at 14:11
  • From what I know there are no additional requirements, besides that list which loocobastos described.
    – Net Runner
    Aug 2, 2017 at 12:58
  • You can maybe add these point : The new password must not be similar than the previous password by X% The new password must not be the same than the X previous password. These two rules my be determined by your sysadmin.
    – locobastos
    Jun 29, 2018 at 13:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .