Re: Password Policy for remote users

There is only one password policy per domain or per machine.
If you will notice, the account policies are not in the User branch but
in the Computer branch of policies. When set in a GPO linked to the
domain object this controls how DCs enforce policy for all domain
accounts, and this or the highest priority GPO setting account policies
applied to a member govern how all the member enforces the policies
for all machine local accounts.

So, to accomplish your stated objective you would need to either
use multiple domains, use a custom gina, or perhaps look as having
a subset of account required to use smart card for login.

"denilia" <denilia@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:3AFA9779-C4A9-40CE-BEDB-658C14CFFBFF@xxxxxxxxxxxxxxxx
Hi experts

I would like to get some clarification and advise. I have 2003 domain with
30 in office users and 10 remote users (VPN only, OWA, POP3). I'm trying
to
enforce a Password policy for office users only. What is the best way?

I'm planning to to do the following steps:
1. Edit GPO to inforce password policy at user configuration level.
2. Check "password never expires" in the account property for remote users
3. Change remote users passowrd to more complex.

Is it secure way to do it? how can I enforce to change password on next
logon?
will remote user password ever expire? I do not want those pepople to be
effected...
I prefer not to crate a separate OU for remote users because I have AD
structured based on peoples roles.

Thank you



.

Relevant Pages

  • Re: Problems testiing GPO for password complexity on OU before changing default domain policy
    ... Account policies are only read at the domain level and you can only have one ... apply to the local machine account policy. ... The complex password policy is applied when I logon to the local machine but not when I logon with a domain user which is a member of the OU and security group within that OU. ...
    (microsoft.public.win2000.active_directory)
  • Re: Password Policy for remote users
    ... Password never expires can be set account by account and this ... the account policies are not in the User branch but ... Check "password never expires" in the account property for remote ... I prefer not to crate a separate OU for remote users because I have AD ...
    (microsoft.public.security)
  • Re: Password Expiration but GPO not in effect.
    ... Account policies are one to a domain. ... level will only take affect when logging on locally. ... You need to set your password policy at the domain level. ... Differing account polices is one reason to create a second domain. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Password expires for no apparent reason
    ... go to the server and run rsop.msc and check your password policy, ... expires' is set for each user. ... the minimum password age is there to prevent users from blowing ... As Harj said Account lockouts could potentially be a problem as perhaps the ...
    (microsoft.public.windows.server.active_directory)
  • Re: Valid password characters
    ... A good password policy should be combined with a good user name ditto. ... whereby an account would be disabled after a certain of unsuccessful ... The attack on this type of protection will not be a frontal attack ... without even the implied warranty of merchantability ...
    (microsoft.public.inetserver.asp.db)