Default domain policy is not working on some users.

Question

The Store password using reversible encryption policy setting is disabled in my AD Policy.

But some of my users are not applied on that policy even after I did the GPUPDATE.

Answer 1

Hello Nikhil Satheesan,

Thank you for posting in Q&A forum.

The Store password using reversible encryption policy setting is disabled by default, even if you did not configure it.

Please check if AD replication works fine if you have more than one DCs in the domain.
Run commands below on PDC to check.
repadmin /showrepl >C:\rep1.txt

repadmin /replsum >C:\rep2.txt

repadmin /showrepl * /csv >c:\repsum.csv

Please check if you have configured FGPP in your domain and apply FGPP to some user.
FGPP takes precedence over the default domain password policy.

Step-by-Step: Enabling and Using Fine-Grained Password Policies in AD.

https://blogs.technet.microsoft.com/canitpro/2013/05/29/step-by-step-enabling-and-using-fine-grained-password-policies-in-ad/

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 2

Thank you for your immediate response.

Actually we don't configure FGPP in our Domain. Only the default policy is used. But in some OU we block inheritance.

Will this effect the default policy.