I'm trying to enforce a password policy on my domain. I've tried setting the policy under The Default Domain Policy, Default Domain Controller Policy, as well as creating a new policy applied to the Domain Controller OU, but nothing seems to work.

I can see from the gpresults wizard that the GPO is being applied, yet the policy is not shown or in effect. Also confirmed that the GPO is listed when running a gpresult /r from the DC, yet the policy does not take effect.

I am applying this as a computer policy to the OU that contains the Domain Controller. Any ideas?


You can only have one password policy via GPO for a domain. It can either be in the Default Domain Policy GPO or it can be in one that you create, link at the domain level, and have set at a higher precedence than Default Domain Policy.

If you need multiple password policies in a domain, and are at (at least) a Windows Server 2008 functional level, then you can use Fine Grained Password Policies but note that these are not linked to OUs, but rather to Security Groups or individual accounts.

  • I tried with one password policy (set on the Default Domain Policy) which did not work, so I next tried the Default Domain Controller Policy, then last the customer policy. Tested with only one at a time, as well as all together. I'm going to kill all of them and try one again. Which would you recommend? Default Domain Policy? – Steve Stoveld Mar 5 '18 at 16:59
  • Default Domain Policy is fine. I'm going to assume that you didn't wait for the domain controllers to refresh their policy. GPO changes are not instant. You need to be patient, or force a policy refresh. – MDMarra Mar 5 '18 at 17:01
  • I did run a gpudate /force in between testing. I had the policy set for max password 90 days, yet when resetting a password, it was still set to expire after the default 42 days. Going to clear out the policies and try under Default Domain Policy now – Steve Stoveld Mar 5 '18 at 17:04
  • If you're creating and using a GPO specifically to set the password policy for the domain then it must be first in the link order when you link it to the domain. My guess is that it wasn't. – joeqwerty Mar 5 '18 at 17:07
  • nope, i'm just an idiot. i had previously moved my default domain policy to a catch-all OU that didn't include the Domain Controllers OU, then applying the other policies on top of it jacked it all up. Fixed the structuring and all good now. thanks – Steve Stoveld Mar 5 '18 at 17:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.