Re: Strong Password setting using GPO

Howdie!

keith c schrieb:
Working with a 2003 AD here. Is it possible to just apply Strong Password settings GPO to individual containers or does it have to be done at the domain level?
Everything I see in documentation references making a copy of the default domain policy. Therefore the reason for the question.

You can only do that on domain level. Multiple Password Policies is not supported in Windows Server 2003 - but there's a bunch of third party software out there than can take care of it.

cheers,

Florian
--
Microsoft MVP - Windows Server - Group Policy.
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
.

Relevant Pages

  • Re: Account Lockout Threshold change - Not taking effect
    ... The GPO (Default Domain Policy) that has the account lockout setting of 5 is ... Are you saying the GPO ... linked at the domain level, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Kerberos User Ticket Lifetime
    ... This policy can only be set at the domain level. ... Joe Richards Microsoft MVP Windows Server Directory Services ... > Maximum User Ticket Lifetime at a userid level, or only at the domain level ... > with the Maximum User Ticket Lifetime parm? ...
    (microsoft.public.security)
  • Re: Password restriction in forest
    ... the Default domain policy (or a policy at the ... domain level higher than the default domain policy) is where the ... changes have to be made on a per domain level. ... Is there a way to do this at the forest level or do I need to go change ...
    (microsoft.public.windows.server.active_directory)
  • Re: Account Lockout Threshold change - Not taking effect
    ... Where did you configure the policy, on domain level in Default domain policy or equivalent? ... This posting is provided "AS IS" with no warranties, ... when I ran the "Net Account" it shows as 5. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Account Lockout Threshold change - Not taking effect
    ... Are you saying the GPO with the 5 attempts setting is not linked at the domain level, but rather it is liniked on an OU somewhere, such as where the Users OU is? ... will have to remove the settings in the Default Domain Policy and not change ...
    (microsoft.public.windows.server.active_directory)