Domain Password Policy

  • Thread starter Thread starter JP
  • Start date Start date
J

JP

Windows 2003 AD -

My domains password policy is at a default, but I wanted to create different
password requirement for a certain OU - and I can NOT - I have a feeling
this is by design - can someone please confirm and also what other
things/limit like this exist?

Thanks.
 
That is by design. Password policy is set at the domain level even though
it seems like you can set it per OU.
It's one of the five major reasons to consider a separate domain for users
and probably one of the most legitimate.

Al
 
Al,

I am sure that you intentionally left this off as it does not apply to what
the original poster is attempting to do....

You can actually set a password policy at the OU level. However, it does
not affect any domain user account object. It would, however, affect any
user account objects that are logging on L O C A L L Y to any computer
account objects that are located in the OU to which this policy is linked.

So, as an example: let's say that you have created an OU called "Client
Systems" and have placed all of your WIN2000 and WIN XP Pro computer account
objects in that OU. Say that you have some users that log on locally ( you
probably would not have that but for this example ..... ) and you want their
passwords to change every 30 days and blah blah blah. You could create a
password policy and link it to the "Client Systems" OU. You make your
settings as desired. Now, when your users log on locally the local accounts
will be subject to what ever settings you configured...

HTH,

Cary
 
The only policy for DOMAIN accounts is the one defined at the domain level.
Password policies defined at OU level will only affect local accounts on
computers located in this OU.

--
Dmitry Korolyov [[email protected]]
MVP: Windows Server - Active Directory


Windows 2003 AD -

My domains password policy is at a default, but I wanted to create
different
password requirement for a certain OU - and I can NOT - I have a feeling
this is by design - can someone please confirm and also what other
things/limit like this exist?

Thanks.
 
Back
Top