Networks

Ask something
Question Locked

Password Policy

0 helpful
7 replies

by jeremytech76

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have used GP Management to setup my password policy:

Must change X days

I created a test OU and added a test user to it. I then, link the GPO to the OU. I also ran gpupdate.exe from the server command line. However, no prompt to change password when I logon as the test user on a workstation.

Maybe it won't for another X days?

And if it won't for X days, how can I be sure that I have set up my policy correctly in the meantime? Or, how can I force all users to change their passwords right now and beging the X day period?

Thanks

7 replies

by nonapeptide

When you log on to this test computer, are you using a domain account or a local computer account?

If you apply a GPO with password policies in it at the domain level, it will affect domain user accounts. If you apply it at a finer level, like OUs, it will NOT affect domain accounts, but rather it will affect local accounts.

Also, I think password policy at a OU level is a machine specific setting, not user specific setting so applying it to an OU with users in it is useless.

Of course, to make things interesting, all of this has changed in Server 08: http://technet.microsoft.com/en-us/magazine/cc137749.aspx

by cg it

funky thing about password in Windows Servers except 2008. only works at the domain level.

That's what child domains are for. So you can have different password policies within a domain.

The ability to set password policies by OU is a great feature of 2008. gets rid of all that child domain structure and allows less administrative effort. One can create an OU structure that mimics a companies organizational chart and then set individual password policies by OU. Well atleast in theory.

I've tried it with W2003 DCs in a W2008 AD environment and couldn't make it work. I've made it work in a pure W2008 environment.

by jeremytech76

I am using a domain account, not tryign to log on to the local machine. Sounds like you hit it on the head concering where I am applying the policy. I am only trying to apply it an OU with a user account in it for testing before I applied it to the domain itself.

SO this leads me to ask: Once I apply the policy at the Domain level, will users be prompted to change their password next time they log on or will this simply start the X days counting I have set in the max password life?

If it only starts the days counting, how can I force all users to change their passwords without goign into the properties of each user object to do so?

Thanks!

by nonapeptide

I would assume that if you started the policy now it would start ticking at this moment, not checking to see how long users have had the password in the past.

If that is the case, set the domain policy to require a password change after 1 day. They'll reset their passwords tomorrow and then after that you can change the domain policy to however many days you like.

by nonapeptide

My response was incomplete in the last post. :-/

I Googled around and couldn't find what the behavior of that GPO setting was. You could apply the GPO to that OU again, and then log on to the local accounts and see how local accounts react to the setting. Maybe the same behavior will exist for domain accounts as well. Not exactly a bullet-proof way of testing it though.

[i]If it only starts the days counting, how can I force all users to change their passwords without goign into the properties of each user object to do so?[/i]

If you didn't want to make the domain policy change user passwords in one day, but absolutely had to force user accounts to change their password now, you might be able to do that with a script and ADSI edit. Well beyond my area of expertise.

by jeremytech76

You've been very helpful, Nonapeptide!

This is a seemingly easy policy, but I am still in my first year and this is my first time messing with GPO's other than reading about them.

I really appreciate your time!

I'll post any updates...

This discussion is closed to new replies.