Re: GPO Password length not working

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 08/20/05 

Date: Fri, 19 Aug 2005 18:13:03 -0500

For "domain users" password account policy is set only at the domain level.
Usually this is Default Domain Policy but it can be any Group Policy linked
to the domain container if you have more than one. Keep in mind that if
there is more than one Group Policy at the domain level then the one at the
top of the list has highest priority as they are applied from bottom up.
Also if you have define a password/account policy setting and later set it
to non defined the effective setting will not change.

You need to make sure that "block inheritance" is not enable for the domain
controller container before you make any password/account policy changes.
You can use the command net accounts on a domain controller to see the
current passwords policy and it should show the same on all domain
controllers. If problems continue run the support tools netdiag, dcdiag, and
gpotool on your domain controller to see if any problems are founds such as
with dns or replication. --- Steve

"CB" <CB@discussions.microsoft.com> wrote in message
news:CD5F4B73-B4B9-44A4-A7C7-4093A4C07A32@microsoft.com...
>I have a mixed mode Windows 2000 and 2003 AD. There are four AD servers.
> There is one main server I always and only use ADUC on. We recently
> implemented a password policy for the company. Previous it was blank
> passwords or anything goes pretty much. Now, it is 2 passwords remembered,
> 90
> days max age, 10 days min age and 6 char length. No complexity turned on.
>
> originally I changed the domain controller policy. Then everyone got
> prompted t change passwords every 42 days. Realized that was the wrong
> policy
> to be setting, so I then changed the domain policy. Every 90 it is asking
> them to change. problem is that they are allowed to set their password to
> any
> length including blank. If I do it as a test, and set the password to
> blank
> or 2 characters, then try and change it back to the original, it won't let
> me
> because of the 2 passwords remembered thing. But it will let me change it
> to
> something different, which it also shouldn'tdo because of the 10 day min
> age
> thing. So some of the policy is working, but the length and min age is
> being
> ignored. The length is the most imprtant one to us. We are just trying to
> make sure that the passwords are at least 6 characters and change every 90
> days.
>
> Anyone know why this is happening?

Relevant Pages

  • Windows 2003R2 Group Policy Errors
    ... Policy from our oldest domain controller to other domain controllers. ... All servers are running Windows 2003 R2 32-bit standard edition. ... Group Policy was working fine for several months, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Failed to open the Group Policy Object
    ... Now gpotool dosent't detect any errors. ... But the initial error (Failed to open the Group Policy Object ... > domain controller default Group Policy for instance. ...
    (microsoft.public.security)
  • Re: Failed to open the Group Policy Object
    ... Dompol.msc is used to open Domain Security Policy yet your gpotool results ... selecting properties - Group Policy. ... domain controller default Group Policy for instance. ...
    (microsoft.public.security)
  • Re: Prevent Domain Users from logging on to specific PCs w/ Group Policies
    ... This user right is defined in the Default Domain Controller Group Policy object and in the local security policy of workstations and servers. ...
    (microsoft.public.windows.server.security)
  • Re: using secpol.msc on win2k3
    ... I downloaded and installed the Group Policy Management ... from the network -> Edit. ... is a domain controller so I'm supposed to use "Domain Controller Security ...
    (microsoft.public.security)