1

On our Active Directory server our Domain Administrator accounts are not forcing resets of passwords after 90 days as defined in our Group Policy:

Activie Directory Group Policy Settings

All Domain Admins are on the group policy. Also, when we pull their expiration dates they are for several months ago. The expiration date has passed. Any ideas on what could be exempting Domain Admins from being forced to reset their passwords?

The users do not have a Password never expires checked.

This is defined in Default Domain Policy.

8
  • What GPO is the setting defined in?
    – Greg Askew
    Sep 14, 2016 at 18:22
  • Default Domain Policy Sep 14, 2016 at 18:30
  • If you run gpresult /h gpresult.html on your domain controllers, does it show the settings in effect?
    – Greg Askew
    Sep 14, 2016 at 18:37
  • Is there more than one password policy in the domain? Sep 14, 2016 at 18:38
  • 1. Password policies are Computer Configuration settings, not User Configuration settings. 2. Have you checked the properties of those user accounts to see if the "Password never expires" checkbox is checked?
    – joeqwerty
    Sep 14, 2016 at 18:39

1 Answer 1

0

Password policy applies to computers which hosts these accounts. Make sure this particular GPO applies to domain controllers as they are the ones which store user accounts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .