Re: Password Policy Problem

From: Leslie R. Thomas (news@SPAMBITEStsoftware.iwarp.com)
Date: 09/03/02


From: "Leslie R. Thomas" <news@SPAMBITEStsoftware.iwarp.com>
Date: Tue, 03 Sep 2002 15:20:37 GMT


Sounds like a group policy somewhere higher in the hierchy is overwriting
your changes. Group policy is applied in the following order, Local, Site,
Domain, OU. Just in case this is not clear....anything you apply locally
can then be overwritten by a Site policy, which can then be overwritten by a
Domain policy, which can then be overwritten by any number of cascading OU
assigned policies. Most of these policies can be blocked at various levels
if that is your desire, but if someone higher than you, administratively
speaking, wants to override your decision, then that also is possible.

"Ralf" <unicorn-munich@web.de> wrote in message
news:b6da01c25298$302939f0$a5e62ecf@tkmsftngxa07...
Hello,

we have quite a similar problem and I thought maybe one of
You can give me a hint.

On the server, who is the PDC operations master, I defined
new password conditions at our "domain name" at the
policy "default domain policy"
the old values were: 42 days, minimum length 0
the new values I set were: 35 days, minimum length 7

But always, after about 10 Minutes my changes are set back
to the "old" values.

Are the values "42 days" , "0 minimum length"
and "password History = 1 day"
a kind of Windows 2000 standard ?
I tried to change the values on all our DCs with the same
effect.
What can be the cause of the set back? a kind of
replication?
I´m member of the enterprise admin group

Can You give me a hint ??
Thanks in advance,
Ralf

>-----Original Message-----
>My Deafult Domain Policy itself has been disabled for
quite some time, I
>will try enabling it for just this policy item. What I'm
wondering is how
>did the change get effected via net accounts command if
it has to be in
>default domain policy, it must be holding this value
somewhere now...?
>
>Brian Mulrooney
>Network Administrator
>Riverside National Bank
>
>
>"Paul Adare" <padare@newsguy.com> wrote in message
>news:MPG.17dbc4167adbe0698970e@msnews.microsoft.com...
>> In article <#46cEgVUCHA.4156@tkmsftngp08>,
xaosflux@bellsouth.net
>> says...
>> > Do these changes need to be set in
>> > Default Domain Policy?
>>
>> Yes!
>>
>> > Additionally I was unable to implement password
>> > complexicity rules from these same places, and it is
not available from
>> > command line. I notice I do NOT have a \%windir%
\system32\passfilt.dll
>> > file...If this is all I need where can I obtain a
replacement?
>>
>> This file is not required in Windows 2000, the
capabilities are built-
>> in.
>>
>> --
>> Paul Adare
>> If you think your wife's jewellery is an investment,
try selling a few
>> pieces.
>
>
>.
>



Relevant Pages

  • Re: Group policy effective in Win 2003
    ... User OU as 5min but the users in User OU the screen saver does not appear after 5min which seems the Director OU is overwriting the User OU, but i cant move the User OU up as alphabetically U comes after D. what should be done so that both the Group policies of respective OU should work ... You created two GPs, one for the DirectoryOU and one for the UserOU and linked the UserOU-GPO to the UserOU and the DirectrOU-GPO to the DirectorOU, correct? ... Can you run rsop.msc on one of the clients to make sure the screensaver policy you configured is winning (meaning there's no other policy overwriting it)? ...
    (microsoft.public.windows.group_policy)
  • Re: can i use w32time to syncronise in a non domain scenario - windows2003
    ...   2) Group policies through Active Directory ... I suspect both policy approaches end up overwriting any locally ... configured registry settings each time the policy is applied, ...
    (comp.protocols.time.ntp)
  • Re: Intermittant GPO failure to apply
    ... If you have backup your group policy before, you can restore it from the ... 244474 How to force Kerberos to use TCP instead of UDP in Windows Server ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • Re: Set GPO for specific user group
    ... Click on the domain name in Group Policy Management, select the GPO and then click the arrow to the left to move it to the top of the list ... Filtering: Denied ...
    (microsoft.public.windows.server.sbs)
  • RE: Remote Assistance not working
    ... I have tried these settings you recommend with no results. ... I have yet to get the offer remote assistance to work when launched from the ... The Group Policy on the computer of the novice user must be configured ... Start the Microsoft Management Console Group Policy snap-in. ...
    (microsoft.public.windows.server.sbs)