Enable password policy on domain

You have to set some sort of "starting point" one way or the other. You can either start as of the current day, as suggested by the previous post, and implement your GPO 60 days from now, and tell people they will have to change their password in 60 days, or you can warn everyone "As of X date, we are implementing a new password policy. You will be required to change your password the first time you log on after X date and every 60 days after that."

Personally, I would do the latter - it gets them to change their password that they've been using for the past months or years immediately, and then warns them that this will be a recurring thing that will happen on a regular basis.

Is this using Windows 2000 server DCs or Windows 2003 server DCs?

There are differences in how W2K and W2003 work.

To : blowtoad : Thanks but in fact I did consider it before. Sad thing is because an external IT audit is coming prob in < 60 days and the mgt wants the policy in place bf the audit. They want it 'painless' for the users too (user-pampering culture). Anyway if there are really no solution I would then persuade mgt to adopt the 2nd option as suggested in the nxt port. Cheers!

To : Synergy : I will persudae the mgt to adopt the 2nd option is there are really no way to 'reset' to a starting point. Cheers!

To : CGIT : Running on Windows 2003. Domain Functional Level is Windows 2003

I think I have found the solution to my answer;

Option 1: Apply the policy first. Then by opening up the each/select all user properties in AD Users and Computers, check User must change password at next logon -> Apply -> uncheck User must change password at next logon, their password last set date will be reset to the current date.

Option 2 : Use a vbs script to do Option 1, by changing the pwdlastset value to -1.

Rf : http://www.mail-archive.com/activedir@mail.activedir.org/msg09819.html