Is it possible to assign strong requirement to a Active Directory domain group? In this case, the strong password would be 8 charters or longer, with at least one capital letter, one lower and one number. They also would need to change their password every 30 days.

Users outside of this group would have another password policy that isn't as tight.

We have an 2003 Active Directory domain.

Thank You for your help.

5 Answers 5


You get one password policy in a domain in Active Directory with Windows Server 2003. You'll have to make a child domain for the users who need a different password policy, or upgrade to Windows Server 2008.

Have a look here: http://technet.microsoft.com/en-us/library/cc770394.aspx

This has been a weakness of Active Directory for a long time, but it's only remidied in W2K8.

  • Correct; this setting can only be implemented for the entire domain. Incidentally, aside from the changing requirement, I wouldn't consider your proposed policy "strong". Password1 satisfies it, for example. Jun 17, 2009 at 18:26

I'm pretty sure that this setting is domain-wide, which means that you would need to establish another tree in your active directory forest. Probably not worth it unless there are other reasons to segregate those user accounts.


Windows Server 2008 Domain Controllers can address this issue now.

Here is a good article with some screenshots.



The best way to solve this problem in windows 2003 is to create a seperate domain. In Windows 2000 and Windows Server 2003, you can only have one password policy, account lockout policy and Kerberos authentication per domain. If you have a subset of users within your domain who absolutely require a different configuration for these items, they need to be configured with a separate domain. To configure a password policy for your domain, create a GPO and link it to your domain, or else modify an existing domain policy that's already in place. The other option is to upgrade to server 2008 AD DS which allows for Fine-Grained Password Policies.


Group policies are applied in the Site -> Domain -> Organizational Unit order. At whatever level you assign your default password policy make sure the "No Override" option is not checked. Then create an new Organization Unit to hold the user accounts you want the different password policy for and create a new group policy on that OU with your specific settings. Other policy settings will be inherited.

  • 1
    BZZT! This won't work for domain user accounts. You can do this for local accounts on member server computers, but domain accounts all get the single domain password policy, constructed as an amalgam of all password policies applied in GPOs at the root of the domain. (Now, why the password policies don't work this way in W2K8 is beyond me. The way that granular password policy was implemented in W2K8 makes no sense, but that's a different story...) Jun 17, 2009 at 18:36

You must log in to answer this question.