Im trying to keep my Default Domain Policy clean and standard and I want to make a GPO for my password policies.

I made it but it still gets the policies from the Default Domain Policy object.

I imagine that it gets that one because it is the most restrictive one but I would enjoy one that I can make a copy of the Default Domain Policy, edit that one, and then apply first that and if something isnt applied/changed/etc, apply the default in the Default Domain Policy.

Is it possible?


Your password policy can be in a group policy you create. There is nothing special about the 'default domain policy' that is created for you.

The Policy you should be applied at the root for the best results. By being linked there directly or inherited from the root, and not be blocked. Password policies are a computer policy and are enforced by the computer with the password database. In the case of your active directory this is your Domain Controllers.

It is likely that you already have password policy settings in existing policies (they are in a default install) So it will be important to make sure the Link order of this new policy is any other policy, though you probably should remove the password settings from any other policies to prevent confusion.

If you look at the Group Policy results for one of your domain controllers you should see what policy and settings are being applied and from what Policy Object if you run into problems.

Separate password policy

Separate password policy

Policy Link order link order

Policy Results.

policy results.

| improve this answer | |
  • Everything I've ever learned about domain password policies says that the password policy GPO shouldn't be linked to the Domain Controllers OU. If it is it won't be applied, as password policies in GPO's linked to OU's don't get applied. It needs to be applied at the domain level, from where the Domain Controllers will pick it up. – joeqwerty Mar 13 '15 at 0:14
  • I have it linked on the Domain Controllers OU on a domain, and it seems to be be working. It is entirely possible I may be making it work against the standard recommendations or best practices. On that particular Domain it is linked in there because their GPOs are a huge mess at the root, and so inheritance got blocked on the DC OU. Cleaning up the GPO disaster is on the to fix list, but the client has very small budget. – Zoredache Mar 13 '15 at 0:17
  • Maybe the Domain Controllers OU is exempt from the "not applied to OU's" processing rule? I've never tried it so I don't know for sure. After all, the AD security account database on the DC's for AD is the database you want the password policy to apply to. The confusion for me has been the fact that a password policy is a computer setting and affects the security account database on those computers the policy is applied to. For a Domain Controller that security account database is the AD database, therefore affecting all AD users, which is a bit of a confusing concept to get your head around. – joeqwerty Mar 13 '15 at 0:22
  • So instead of applying it at domain level and/or OU level, I have to apply it in the Default Domain Controllers Policy (by applying I mean adding a new policy besides this one, putting the link higher, and thats it?). Ive tried putting it in domain level, in a OU with only computers, etc. and it always applies the Default Domain Policy. Ive checked with gpresult /r and it is being applied but...in reality it isnt. – riahc3 Mar 13 '15 at 6:56
  • I think you've missed what Zoredache stated about the link order for your GPO. You can link it to the domain, or as Zoredache stated, to the Domain Controller's OU, but in either case it has to have the lowest link order so that it has the highest precedence so that it is applied last and will therefore be the "winning" GPO. – joeqwerty Mar 13 '15 at 15:24

Password policies set on the Default Domain Policy always apply over and above any other password policy unless you're using FGPP somewhere down the line.

it's fine to have it at the root of the domain, that's where it should be.

If you want to apply a separate password policy then you need to set all the password settings in the Default Policy to "Not Set" and then create a new GPO (or use another pre-existing one) to apply the password settings at the same, or a different level.

| improve this answer | |
  • " Password policies set on the Default Domain Policy always apply over and above any other password policy unless you're using FGPP somewhere down the line." Wrong. You need FGPP only to have different PP simultaneously. But you can define multiple PP besides the DDP and only one of them will be valid. The first, that is linked to the highest level in the domain tree, or the first one that is enforced. – Thomas Jul 16 at 12:13

Create password settings defined in Active Directory Administration Center > Select your Domain > Select the System Container > Select Password Settings Container > Select "New" > Select Password Settings.

Here you can apply policies based on individual groups or users that are separate than the domain policy.

Use precedence to manage multiple policies that may apply to the same group of users.

I hope this helps.


| improve this answer | |

First things first. The password policy is only relevant for authorities that change passwords. In an AD domain, this is the DC that owns the PDC emulator FSMO role. As a consequence, in a default environment there are only two spots where you can apply a password policy in theory:

  1. The domain (root)
  2. The OU "Domain Controllers" (directly below the domain root)

So if you apply a password policy on an OU that does not contain the PDC emulator somewhere, it can and will not have any effect. You will see the settings on a client though when viewing with secpol.msc, but they are meaningless. Only the settings that apply to the PDC emulator will count.

Now, there is something special about password policies. They are designed to apply to the whole domain. MS therefore does not support password policies that are applied to the "Domain Controllers" OU. So your only playground left is the domain. There you can indeed have a custom GPO that contains password policies. To win against the Default Domain Policy or other GPOs that contain password policies, you have two possibilities:

  1. Enforce your custom GPO (assuming it will be the first enforced GPO on domain level)
  2. Move your custom GPO above all other GPOs (containing password policies and assuming they are not enforced) concerning the link order. That means give it a smaller number. The GPOs are applied in reverse order, so the GPO with link order number 1 will be applied last and thus will win.
| improve this answer | |

I tried to do in the past without success. Password policies have to apply in the Default Domain Policy to work.

| improve this answer | |
  • 2
    It works. You just have to do it right. Meaning you like it in the right place at a higher link order then any default policies. – Zoredache Mar 12 '15 at 23:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.