I found this article: AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide really useful to set fine-grained password policies for a user or a Security Group.

But I haven't found any way to do this at an OU level - at least not any way that I can get it to work.

Any good articles that show how to do this?

  • 2
    Did you miss this statement in that article? PSOs cannot be applied to organizational units (OUs) directly. – Zoredache Jun 28 '12 at 19:37
  • Me bad. I dived right in to Step 1! – rbrayb Jun 28 '12 at 19:50

You cannot apply FGPP to an OU directly.


Fine-grained password policy cannot be applied to an organizational unit (OU) directly. To apply fine-grained password policy to users of an OU, you can use a shadow group.

A shadow group is a global security group that is logically mapped to an OU to enforce a fine-grained password policy. You add users of the OU as members of the newly created shadow group and then apply the fine-grained password policy to this shadow group. You can create additional shadow groups for other OUs as needed. If you move a user from one OU to another, you must update the membership of the corresponding shadow groups.

| improve this answer | |
  • 2
    Yep. Make a group. Put everyone in the OU that you want to target in that group. Done. – MDMarra Jun 28 '12 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.