All,
Here is the situation. I have a large domain with over 4000 users. There are several services that need to run as a domain user, for example Cluster Services, Backup Services, etc. Of course I do not want to run these all as domain administrator and of course some of them do not need to be domain admins. HOWEVER, I do not want theses accounts to be easily locked out based on the current password policy setting (for example lets say it is 3 mistyped password and the account is locked out) while at the same time retaining these strict password policies for the rest of my users.
What I have tried/read:
Well, first off I read/heard/tried that you can not apply password policies at the OU level. They must be set on the domain level. So here is what I have done, all of these service accounts get put into a created group called “My Service Account Group”. A GPO is created at the domain level, “Authenticated Users” is removed from the security tab and “My Service Account Group” is added and given the “Apply Policy” permissions. This GPO does not have the strict lock out policy but instead has a policy that says the account passwords must be over 12 characters. (after all, if I am removing lock outs for these account I better make sure their passwords are harder to crack). The created policy is moved to the top pf the GPO list on the domain container. Then on the normal “domain default” policy the “My Service Account Group” is denyed the “Apply this policy” right.
So that all sounds right and yet that isn’t working. What am I doing wrong, what am I missing?
Things to note: The domain is not in native mode. The domain is not the forest head but it is the domain that all the users accounts are in.