1

How can I remove the minimum password length for a specified user in an OU? (I do not want the default domain password policy affecting my GPO.)

When the "minimum password length" in my default domain GPO is not configure, things work like I want, but if I configure the minimum password length, it applies to my GPO, which I don't want.

The OU in question has users, "ali" and "reza." I want Ali to get the default domain policy and Reza to get my GPO.

How do I do it so that Reza doesn't get the password policy in the domain default GPO, but Ali does?

5

What you're talking about is a feature called "fine-grained password policies", and requires a domain functional level of Server 2008 or higher.

There's a nice, easy step-by-step instruction guide on enabling and using fine-grained password policies on the Technet blogs, if you'd like to take a look, but it's not all that complicated. The thing that trips most people up is trying to do this with simple GPO inheritance and OU structure, without enabling the feature (or not having the required domain functional level to use the feature).

The basics of it, though, are that you enable the feature, use a PSO (Password Settings Container) with the password settings you want, and apply that PSO to Reza.

  • i how do this with simple GPO inheritance and OU structure, without enabling the feature ? – Ehsan Jan 21 '15 at 14:47
  • 5
    @ehsan you can't, FGPP was added to specifically address the need for multiple password policies. – Jim B Jan 21 '15 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.