GROUP POLICIES PASSWORD POLICIES

Question

GROUP POLICIES PASSWORD POLICIES

skak 21

Hello, I have Windows 2016 Server with 400 users which has several OU's and would like to implement the password policies. I ALSO HAVE SERVICE ACCOUNTS. How is it If make password policies directly on the default domain policies ? what problems will I have ? Is it possible to have password policies per OU ?

1 answer

Your answer

Answer 1

Thameur-BOURBITA 36,261 Moderator

Hi @skak •

Through GPO you can apply only one poicy for all domain users through the GPO Default domain Policy . In another hand You can create many Passowrd Policy using FGPP Fine Grained Password Policy and apply them on specific users or AD group.

You can create a policy for each kind of account : VIP , service accounts , admins ..ect To get more details about FGPP I invite your to read the following links: AD DS: Fine-Grained Password Policies Fine-Grained Password Policy in Active Directory

Please don't forget accept helpful answer

skak 21 Reputation points

2024-01-23T10:17:01.6833333+00:00

You mean to say that I should create on default domain policy for the password policy and create different groups for service accounts and administrators accounts and create fine grained password for each. If I have understood correct then default domain policy would not take precedence over the fine grain password policy ? Thanks
Thameur-BOURBITA 36,261 Reputation points Moderator

2024-01-23T10:43:10.8766667+00:00

@skak

You mean to say that I should create on default domain policy for the password policy and create different groups for service accounts and administrators accounts and create fine grained password for each.

Yes the default domain policy will be applied by default on all domain users not assigned to a FGPP. The FGPP will overwrite the policy of Default domain policy on admins and service accounts If I have understood correct then default domain policy would not take precedence over the fine grain password policy ?

When you add a user to apply a FGPP policy , FGPP will replace policy applied through Default domain policy. Default domain Policy will be applied only on somain users wuthout FGPP.

Please don't forget to accept helpful answer
skak 21 Reputation points

2024-01-23T11:39:07.7666667+00:00

Thanks
Thameur-BOURBITA 36,261 Reputation points Moderator

2024-01-23T12:28:52.4933333+00:00

@skak You are welcome.

Please don't forget to accept helpful answer
Anonymous

2024-01-24T07:44:53.8633333+00:00

Hello skak, Thank you for posting in Q&A forum. The GPO default domain policy applies a password policy to all domain users in the domain, including the OUs under the domain. You can use FGPP to create multiple password policies for specific users and groups and apply them to specific users and groups. The FGPP allows administrators to create multiple Custom Password Setting Objects (PSOs) in an AD domain. PSO policies can be assigned to specific users or groups, but not to Active Directory containers (OUs). If you assign a PSO to a user, the password policy settings in the default domain policy GPO will no longer be applied to that user. Fine-Grained password policies can't be applied directly to organizational units (OUs). To apply FGPP to OU users, you can use groups, you can create different groups and put users within different OUs into different groups (for example: put users in OU1 into group1, put users in OU2 to group2 and so on). Create Fine Grained Password Policy (Step-by-Step-Guide) https://activedirectorypro.com/create-fine-grained-password-policies/ I hope the information above is helpful. If you have any question or concern, please feel free to let us know. Best Regards, Daisy Zhou

If the Answer is helpful, please click "Accept Answer" and upvote it.
Thameur-BOURBITA 36,261 Reputation points Moderator

2024-01-24T09:00:39.28+00:00

@skak

Just checking if you need another clarification

Please don't forget to accept helpful any update and clos this thread

Share via

GROUP POLICIES PASSWORD POLICIES

1 answer

Your answer