3

We have a bunch of GPOs that have grown organically over time. I assume that many of them are defining password policies. I am aware of the fact that it only can be set once in a domain (besides PSOs and the special case where a GPO is linked to a computer object only affecting the local user accounts)

So the question is: How can I find all GPOs in a domain that define password policies?

  • How many GPO's do you have exactly? It's not that difficult to highlight them in GPMC, select the settings tab and look at them. The section you need to look at is right at the top: Computer Configuration|Policies|Windows Settings|Security Settings|Account Policies/Password Policy. – joeqwerty Feb 17 '15 at 15:28
  • Near to 300 GPOs... so this would be a very repetitive task – Matze Feb 17 '15 at 15:33
  • Similar question in a different thread. See my answer [here][1]. [1]: serverfault.com/a/665618/100940 – Clayton Feb 17 '15 at 16:00
2

You can use a script that Microsoft developed over on Technet:

Check a setting in all GPO's (Security, ADMX, and more)

You can export an existing GPO like the Default Domain Policy as XML (right click the GPO in GPMC and "Save Report" as XML) to look in and see the various "choices" based on how the script functions.

For example, here's some output from a GPO that sets password policies:

Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Security" xsi:type="q1:SecuritySettings">
        <q1:Account>
          <q1:Name>ClearTextPassword</q1:Name>
          <q1:SettingBoolean>false</q1:SettingBoolean>
          <q1:Type>Password</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>LockoutBadCount</q1:Name>
          <q1:SettingNumber>0</q1:SettingNumber>
          <q1:Type>Account Lockout</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>MaximumPasswordAge</q1:Name>
          <q1:SettingNumber>30</q1:SettingNumber>
          <q1:Type>Password</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>MinimumPasswordAge</q1:Name>
          <q1:SettingNumber>0</q1:SettingNumber>
          <q1:Type>Password</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>MinimumPasswordLength</q1:Name>
          <q1:SettingNumber>7</q1:SettingNumber>
          <q1:Type>Password</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>PasswordComplexity</q1:Name>
          <q1:SettingBoolean>true</q1:SettingBoolean>
          <q1:Type>Password</q1:Type>
        </q1:Account>

For password policies you can use the script with something like the following syntax:

.\SearchGPOsForSetting.ps1 -IsComputerConfiguration $true -Extension Security -Where Name -Is PasswordComplexity

to find any GPO where the PasswordComplexity is set.

You can modify the script to your own needs if you understand PS scripts, but the basics are there to get what you want.

  • That is exactly what I am looking for. Unfortunately the script is very buggy. After having fixed the param section the following shows up: Get-Member : Cannot validate argument on parameter 'Name'. The argument is null or empty.[...] Anyone got a working copy? – Matze Feb 17 '15 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.