For my organization of around 6000 users, I just did three things.
- Set "Default Domain Policy" password requirements to "not defined"
- Set a Fine Grained Password Policy for your basic 8 characters w/ complexity for Domain Users
- Set a Fine Grained Password Policy for IT (in the IT group, about 100) with more strict rules, and gave it higher priority
The reason I have a FGPP for Domain Users is so I can adjust the priority.
Since then, I've had zero issues with the majority of my 6000 users. However, about a dozen of the IT employees are having their accounts locked out the moment they lock their screens and try to log in again.
I've used lockoutstatus.exe and see that bad passwords are being hit against two of our three DC's, but I can't pinpoint what's doing it.
This is a separate issue, but our Event Viewer logs overwrite themselves after 20 minutes and it's difficult to sort through it, we get about a million events per hour and the event view only stores 8gigs per category. I bring this up because I can't reliably use Event Viewer on our DC's to help pinpoint this.
While we forced some users to change their password, two of the users having this issue were exempt a forced password reset, so their credentials haven't changed at all during any of this.
Any tools or tips to help me out?