Active directory password - additional policy

Question

Hello!

Can you tell me please, do I understand correctly that, as it was before and is still the case, it is impossible to configure different password policies for PCs and users in the AD domain via group policy (gpmc / gpedit)?

Even if you create a new OU and target it with a new policy with password settings, the new data will be displayed, but will not actually be applied, is that right? And the only working option for creating different password requirements - is FGPP

And what will happen if the “Domain password settings” policy is applied on the domain, indicating the necessary settings, and another policy is applied on the OU with DC, like “Domain Controller password settings”? Which settings will be applied and will there be any difference at all from the second policy for DC?

Answer 1

Hello Step to IT,

Thank you for posting in Q&A forum.

it is impossible to configure different password policies for PCs and users in the AD domain via group policy (gpmc / gpedit)?
A1: Yes, based on my knowledge, I think so.

Even if you create a new OU and target it with a new policy with password settings, the new data will be displayed, but will not actually be applied, is that right? And the only working option for creating different password requirements - is FGPP

A2: Yes. If you want to configure one password policy different than default domain password policy, you can configure FGPP.

And what will happen if the “Domain password settings” policy is applied on the domain, indicating the necessary settings, and another policy is applied on the OU with DC, like “Domain Controller password settings”? Which settings will be applied and will there be any difference at all from the second policy for DC?
A3: Password policy within "Default Domain Policy" will be applied (in my test).

FGPP is applied to users or groups. Default domain policy is applied to domain-joined computers.

For the same users or groups, if there is a default domain password policy and FGPP is applied, the priority of FGPP is higher than the default domain password policy.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Not exactly.

The password policy defined in the Default Domain Policy GPO applies by default to domain accounts and local accounts on domain-joined computers.

You can modify the password policy of local accounts on domain-joined computers by using GPOs linked to OUs where the domain-joined computers reside.

You can modify the password policy of individual domain accounts by using FGPP

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin