2

I have one Windows Server 2003 VM that I need to disable the Password Complexity policy for Local users on. I still want the Active Directory users to use the domain Password Complexity Policy.

Is there a way to do this?

[More background info for those who are curious: I am going to be using the users on the server as an authentication piece for a 3rd party tool. The local users will have no rights on the machine. They just need to exist to authenticate against. Because the 3rd party tool is for mobile devices, I don't want my users to have to type in complex passwords. (It would quickly become tedious on a mobile device.)]

Improve this question

1 Answer 1

Reset to default
4

Your member computer is picking up its local password policy settings from the "Default Domain Policy" (in a stock configuration) but you can override it by applying a group policy object with the password policy settings you'd like at the OU of that machine (or, really, anywhere lower than the top of the domain but above that computer object's path).

As long as you don't put another password policy into a GPO at the root of the domain you won't cause changes to the domain-wide password policy (used for AD accounts by domain controllers).

You might see things about granular password policies in W2K8, but this isn't what you're looking for. What you want can be done in every version of AD back to W2K, because it only applies to local accounts on member computers.

Improve this answer
2
  • +1 for differentiating between the granular password policies in w2k8 and the local policies - I was about to mention it until this reminded me
    – Izzy
    Jul 6, 2009 at 16:53
  • 1
    Heh heh... It's easy to think of the granular password policy first. (It's disappointing to me that Microsoft didn't implement granular password policy by way of applying GPOs with password policies to users. All the infrastructure was there already to do that, but instead they created these new objects and behaviours for W2K8. I suppose, since password policy is a computer attribute, it would've seemed a little strange to apply them to users, but that would have been more logical to me than creating totally new infrastructure. Oh, well-- nobody asked me.)
    – Evan Anderson
    Jul 6, 2009 at 16:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .