I'm creating a domain and I need to make users that can have an empty password but administrators have to comply with password complexity how to I solve this problem?

Thanks in advance

  • users with empty passwords = trouble brewing
    – Chris S
    May 23, 2010 at 13:55

2 Answers 2


Windows 2008 has the ability to setup fine-grained password policies.

Microsoft says this:

You can use fine-grained password policies to apply different restrictions for password and account lockout policies to different sets of users in a domain.

Here are some links to documentation and a HOWTO about fine-grained password policies.

  • +1, This is possible now, but it's not very easy to setup yet. Maybe the next version of Windows will fix this.
    – Chris S
    May 23, 2010 at 13:53

I've been working through my first AD install the last couple of days and ran into this headfirst.

  1. Local security policy dictates the policies for the computer you're working on. If the domain isn't yet set up, this is where you'll find what you need. (Account settings -> Password Complexity) While you're there you might also want to nuke the password length requirement. If the domain IS set up, the GROUP POLICY defines these password settings and therefore they're greyed out in local security.

  2. When the domain has been set up, you need to go look in Group Policy Management -> Default Domain Policy. RIGHT CLICK -> Edit -> Computer Config: Policies -> Windows settings -> Security settings -> Account policies -> * You can either change the setting, or release the setting which would then allow you to edit in local security policy.

Now, if you edit the policy in Default Domain Policy, it will become the policy attributed to any system joined to the domain. But I assume you want all your computers to have this policy if your DC has it. One thing to keep in mind is that the password complexity setting IS there for a reason.

  • It may sound pedantic, but I'd recommend not editing the Default Domain Policy. Simply create a new GPO, titled "Default Domain Policy Delta" [or some-such] and link it the same as the Default Domain Policy. Order this new GPO to have precedence. Put all your changes to the Default Domain Policy within this new GPO instead.
    – jscott
    May 23, 2010 at 13:24
  • @jscott, better practice yet, make a new GPO, call it Security & Password Policies, and put in it all of your domain Security and Password related policies, and nothing else.
    – Chris S
    May 23, 2010 at 13:54
  • the OP asked how to set two different policies for different users; not just how to setup a policy in the first place.
    – Chris S
    May 23, 2010 at 13:56

You must log in to answer this question.