In my Samba Active Directory Domain, I want to allow passwords that are long (passphrase) and based only on small caps and special characters, i.e. no requirement for large caps and numbers.
In order to do so, I created a new domain wide GPO for authenticated users where I disabled the complexity check (
Password must meet password complexity requirement) and instead increased the minimum password length to 10.
gpupdate to make sure the policy was distributed to the computer I'm sitting on. Unfortunately, this didn't have the expected effect, I still get the error message that my new password is not in line with the password policy.
A quick check using
gpresult /v reveals the following information:
Account Policies ---------------- GPO: Default Domain Policy Policy: MaximumPasswordAge Computer Setting: 180 GPO: Default Domain Policy Policy: MinimumPasswordAge Computer Setting: 15 GPO: Default Domain Policy Policy: MinimumPasswordLength Computer Setting: 10 Security Options ---------------- GPO: Default Domain Policy Policy: PasswordComplexity Computer Setting: Not Enabled
What went wrong?
Update: Since a few commenters suggested I should do it via the Default Policy, I did that. The result remains exactly the same. I am attaching a screenshot of the policy just to avoid any doubt.
And here is a screenshot of the local security policy which confirms that the GPO was indeed applied. It looks fine but I can still create 8 digit passwords for domain users and they must include large caps and a number.