I'm new to the Server administration game. I'm about to push out my first group policy concerning passwords.

I'm going to do something simple. Use MS's built in complexity requirements and an max age of 6 months or so.

Quick background. I'm the first person this company has had in their IT dept. I'm trying to get everything figured out and settled. It seems half or so of the users (about 150) have the "Password never expires" checked in active directory user properties.

If I use a group policy for passwords will the GP supersede the AD user properties settings?

If not. Do I just go through AD and uncheck that for all accounts I want to be forced to change their passwords?

Thanks in advance. Let me know if there's anymore info you need!


Enabling "Password never expires" will override any password expiration policy you configure in Group Policy.

But you can configure this setting much faster, without using dsa.msc. To list all user accounts with "Password never expires" set:

dsquery *  -filter "(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=65536))" -limit 0

To disable the setting for these users:

dsquery *  -filter "(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=65536))" -limit 0 | dsmod user -pwdneverexpires no
  • +1...a much better answer than mine :-)
    – Jason Berg
    Jan 24 '11 at 21:32

If "Password never expires" is set in AD, your group policy will not force them to change their passwords. Everything else in GP will apply to the accounts though.

Instead of unchecking everyone's account, you can do a bulk property edit by selecting multiple users (or all users) in an OU and editing the property once to state that passwords do expire.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.