Hello Paul Bergson [MVP-DS],
i tested a bit , maybe i did wrong tests, but i was not able, even
with denying the DDP to the test computer account and test user
acccount, blocking policy inheritance on the OU wher the test
computer and test user where located, to get an other password
setting with 8 characters applied (DDP is 12 characters).
With secedit command i refreshed the machine policy and also reboot
multiple times the machine after replicating the change to the other
domain controllers, all in the same site. Gpresult shows the DDP not
and only shows the test GPO with the new password setting. But if the
user tries to change the password to lower characters it gets an
error about the minimum of 12 characters.
That is wahat i expected and also meant on my reply that password
policies are domain-wide and cannot be defined per OU.
Also according to Morgans reply, maybe we talk about different
topic???
http://social.microsoft.com/Forums/en-US/winservergen/thread/4d647455
-8687-40b7-b466-538fefa13e4b
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and
confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!!
http://www.blakjak.demon.co.uk/mul_crss.htm
Sure you can block individuals. Just deny on read and apply.
http://www.pbbergs.com
Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no
rights.
Hello Paul Bergson [MVP-DS],
But as far as i know the password policy settings are not blocked,
even if block inheritance is set. I do not mean the local machines,
when the computer is not connected to the domain.
The only option i know is using block inheritance on the DC's OU.
But this is not the case here, because only 2 users have the
problem.
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties,
and
confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!!
http://www.blakjak.demon.co.uk/mul_crss.htm
You can block a policy to be applied against an OU or even an
object within that OU. This is what I'm guessing has happened
here
http://www.pbbergs.com
Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers
no rights.
Hello Jason,
How did you configure the password policy to NOT apply only for 2
users? By default this is not possible in AD. Password policy has
to be configured on domain level and applies to ALL.
If you add/change the password policy at a certain time it takes
into account when the setting, in your example 45 days, is valid,
change date + 45 days. Or if the user changes the password itself
or you set the checkmark "User has to change password at next
logon"
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties,
and
confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!!
http://www.blakjak.demon.co.uk/mul_crss.htm
Hi All,
Just a tricky question.
* We have a password policy requesting users to change password
every 45 days. * We have two user accounts (user a and user b)
that are over 400 days old and currently not inheriting the
password policy.
Question 1
1) If we made 'user a' inherit the password policy, when will
they
be
prompted to change their password? Will it be at first login (as
password is
over 400 days old), or 45 days from the date of when the
password
policy was
applied?
2) Is we made 'user b' inherit the password policy and then
reset
their password to what is previously was, when will they be
prompted
to change their password? At first login or 45 days from date of
password reset?
Thanks
Jason
Thanks
Jason
