RE: Group Policy: multiple password policies in the same domain?

From: Delgado, Jacob M. (jmdelgad_at_unoh.edu)
Date: 08/31/05

  • Next message: Fredericks, Michael: "RE: Active Directory password external use" 
    Date: Wed, 31 Aug 2005 10:22:27 -0400
To: "Derick Anderson" <danderson@vikus.com>, <focus-ms@securityfocus.com>

    Derick,

    Active Directory password policies are set at the domain level. At all
    other levels, the policy is just ignored. All domain accounts will have
    the same policy applied. If you want different policies for different
    users, they have to reside in a different domain.

    http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technolog
    ies/directory/activedirectory/stepbystep/strngpw.mspx

    Jacob Delgado
    Network Administrator
    University of Northwestern Ohio

    -----Original Message-----
    From: Derick Anderson [mailto:danderson@vikus.com]
    Sent: Wednesday, August 31, 2005 7:32 AM
    To: focus-ms@securityfocus.com
    Subject: Group Policy: multiple password policies in the same domain?

    I'm trying to lock down some domain "service" accounts (backup,
    Exchange, SQL Server, Scheduled Tasks, etc.) where I work. We're an
    application service provider (web-based) and we have only one domain at
    the moment (sigh), shared by our production servers (big sigh) on the
    same physical network (very big sigh). Our web application must run as a
    domain account (throws up hands in exasperation).

    Splitting the domain into production and non-production is in the works
    but will realistically be at least a couple months away. In the mean
    time I'm trying to enforce stronger passwords for service accounts like
    those I mentioned above but I'm having problems using Group Policy to
    specify that service accounts have a certain password policy while
    regular users have another. I believe the problem is that password
    policies are computer based instead of user based, so I can't specify
    that specific users have one set of password policies while others have
    a different one.

    Would applying the policy to a specific set of computers affect only the
    local accounts on those computers, or the entire domain? My theory is
    that only the password policy on the domain controllers would affect
    domain passwords, but I'd love to hear differently.

    Any help would be appreciated.

    Thanks,

    Derick Anderson

    ------------------------------------------------------------------------ 

    ---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Fredericks, Michael: "RE: Active Directory password external use"

    Relevant Pages

    • Re: Password Policy Basics
      ... but assumed the POLICY would be applied to ALL ... so lcoal machines might start enforcing that policy on ... No, the local accounts are not effected by the domain policy, except you link the policy also to the OU like Florian states. ... I was thinking of service accounts on the servers... ...
      (microsoft.public.windows.group_policy)
    • RE: Group Policy: multiple password policies in the same domain?
      ... Subject: Group Policy: multiple password policies in the same ... service accounts, and our company must be SAS70 type-II certified. ...
      (Focus-Microsoft)
    • RE: Group Policy: multiple password policies in the same domain?
      ... I'd suspected that you might be able to use a different GPO at the same level but having never tested it I didn't want to committ it to writing! ... Subject: Group Policy: multiple password policies in the same ... You can only affect domain> accounts at the domain level, but you do NOT have to use the> "Default Domain Policy" GPO. ...
      (Focus-Microsoft)
    • Re: Local setting vs. Effective setting w/ GP??
      ... Password policies do not override local policies. ... >>> local policy affects local account meanwhile domain policy affects domain>> accounts. ...
      (microsoft.public.win2000.active_directory)
    • Re: Password Policy Basics
      ... set up a password policy via Group Policy, ... change only the DOMAIN login accounts, not all the local accounts too. ... But what local service accounts do you have? ... For this option NEVER use an Administrator account for service accounts or configuration tasks, create for your service accounts always new accounts without a profile and only the minimum rights for that service and a really strong password, that you have to save on a secure plcae. ...
      (microsoft.public.windows.group_policy)