Re: Different password policys?

From: Dave Sayers [MS] (dsayers@online.microsoft.com)
Date: 07/02/02 

From: "Dave Sayers [MS]" <dsayers@online.microsoft.com>
Date: Tue, 2 Jul 2002 09:56:55 +0100

If you set Password Policy at the OU level, it will only affect the SAM
database (ie local users) on any machines in that OU. To affect domain
users, the password policy can only be set at the domain level. That is why
your client machine has number of remembered passwords set to 0. This
setting should work if you log on as a local user using an account in the
SAM of that machine. However, if you log on using a domain user account (as
it sounds like you are doing in your test), the domain settings will take
effect.

hth 

--
--
Regards,
Dave
--
Dave Sayers [MS]
This posting is provided "AS IS" with no warranties, and confers no rights.
Please do not send email directly to this alias. This alias is for newsgroup
purposes only.
"Jerry Haugeto" <jerry.haugeto@got.sema.se> wrote in message
news:#HPdVFZICHA.2280@tkmsftngp12...
> Hmm, ok but why can I see that the settings changes on the machine when I
> look
> at the local policies?
>
> Does that mean that it applies the policies but just does'nt look at them
> locally?
>
> If this is the case, will this be changed in .NET AD?
>
> If you want to create an ASP solution you would really want this
> solution....
>
> /Jerry
>
>
> "Dronic" <dronic (at) myrealbox.com> wrote in message
> news:3d208598$0$8159$ba620e4c@news.skynet.be...
> > You answered your own question. Password policy is a setting on the
domain
> > level. So if you want different password policies you need different
> > domains. No matter what you do with you OU's.
> >
> > "Jerry Haugeto" <jerry.haugeto@got.sema.se> wrote in message
> > news:us7d7oQICHA.1928@tkmsftngp13...
> > > Hi guys!
> > >
> > > I've been reading about having different password policys in one
domain
> is
> > > a problem because it's a domain wide setting.
> > >
> > > But I've also read that if a Group Policy is set at an OU, then it
> should
> > > carry out those settings?
> > >
> > > I've tried this and have some problems....
> > >
> > > I've setup an OU with a different password policy than the Default
> domain
> > > policy, the policy also
> > > blocks and uses no override against other policys.
> > >
> > > In this OU I've placed the computer account of the workstation that
I'm
> > > testing this on, everything is synched and ok.
> > >
> > > The idea is that I want the users to be able to change the passwords
> back
> > to
> > > the one they had before.
> > > In order to do this I've set Passwordhistory:0, Minimum password
age:0.
> > >
> > > If I look at the local policy on the machine I can see that those
values
> > are
> > > the one's considered 'effective' on the machine.
> > > I can also see that the computer reads the specified policy and not
the
> > > domain policy through gpresult.exe.
> > >
> > > But still I can't change the password back to the same as last time,
it
> > > says: at least one password is rememberd....
> > >
> > > Why?!
> > >
> > > Should'nt this work?
> > >
> > > /Jerry
> > >
> > >
> > >
> >
> >
>
>

Relevant Pages

  • Re: 2003 Domain Password Policy with NT 4.0 Workstations
    ... The only way to exclude users from adhering to the domain password policy is ... > running Windows NT 4.0, so would the following scenario work? ... Modify the Default Domain Policy and remove the Account ...
    (microsoft.public.windows.server.active_directory)
  • Re: Reasons and examples for security
    ... > One thing that is totally unneeded but which would facilitate ... > is if there were some champion in MS to take up getting a ... > mod to the gina so that there were a password policy to ... > on length minimum and relationship with complexity policy). ...
    (microsoft.public.security)
  • Re: GPO configuration
    ... > There natively is no possible way to override/bypass domain password policy ... > GPO's for password/account policy. ... >> does an account/password policy applied at the domain level override OU ... I thought the lower GPO policies would overwrite the upper levels ...
    (microsoft.public.cert.exam.mcse)
  • Re: Password policy
    ... Make sure that you configure domain password policy at the domain level ... Group Policy in the domain container then the Group Policy at the top of the ...
    (microsoft.public.windows.server.security)
  • Re: Group Policy to affect local user accounts? (point and print restrictions)
    ... Using GPMC or group policy editor create a group policy that covers the ... these changes are in the local user policy of each client PC. ... Can I not use domain group policy to affect local users on client PC's ...
    (microsoft.public.windows.group_policy)