How do you do....it? Thread, How to change Maximum Password Age through GPO in Technical; My server comes up with a message your password will expire in so many days would you like to change ...
15th January 2008, 11:19 PM #1
- Rep Power
How to change Maximum Password Age through GPO
My server comes up with a message your password will expire in so many days would you like to change your password, after every 42 days. But I want to keep the same password. to acheive that I opened the GPO and under Password Policies I clicked on Maximum Password Age to disable it but it is grayed out and does not allow me to change anything. It must be something very simple please let me know how to disable the maximum password age through GPO.
Last edited by shirzay; 15th January 2008 at 11:22 PM.
IDG Tech News
16th January 2008, 09:58 AM #2
You will find policies for this here:
Computer Config > Windows Settings > Security Settings > Account Policies > Password Policy
16th January 2008, 10:11 AM #3
Do you want to do this for everyone, or just you?
In Active Directory, find your user; right click and go to properties; select the account tab and check "Password never expires"... that applies regardles of Group Policy
16th January 2008, 02:51 PM #4
I think @shirzay knows where to find it, but is saying it is grayed out and he can't change it. I have just checked my domain policy and I can edit it fine - no graying out. But I don't know enough about GPOs and their interdependencies to know why a GPOs setting would be grayed out. Perhaps there is another GPO higher up that overules the one @shirzay is trying to edit???
Originally Posted by mrforgetful
17th January 2008, 09:36 AM #5
Oh yeh sorry, see this is why I have to read every word and can't skim through like most people!
I've no idea why a policy would be grayed out. It would not matter if there was a setting higher up negating the option in a policy lower down, one would just get overridden.
22nd January 2008, 11:24 PM #6
are you using an administrator account?
14th November 2008, 03:53 PM #7
- Rep Power
Change password requirements for all users (Server 2003)
If you want to change the password requirements (such as password age and complexity) for all users you do so through Administrative Tools. Look for Domain Security Policy and then Account Policies and then Password Policies. You should be able to make the changes from here and they will be reflected when you view them in the Group Policy window.
Originally Posted by shirzay
25th November 2008, 12:21 PM #8
Further to this. How do I enforce password age just for users in an OU? As I just want staff to change their passwords and not students who are in a different OU.
25th November 2008, 12:23 PM #9
It's a machine setting, you could try using Loopback Processing but I'm not sure it will work very well.
28th November 2008, 11:11 PM #10
Create separate policies for the different user groups (you may already have these - eg. Student Policy, Teacher policy, etc.), put the setting for password age in these, link the policies to the relevant OUs, then remove password age from the domain policy? Someone more experienced than me should be able to confirm this or tell you if I'm speaking rubbish!
Originally Posted by Jobos
15th December 2008, 12:29 AM #11
15th December 2008, 08:01 AM #12
No, password policies are an exception to this unless you're using Server 2008. Anything else can only have one password policy per domain.
Originally Posted by Andie
15th December 2008, 08:47 AM #13
You can have granular Password Policies (Ie Different OU's have different password Policies) with Windows 2008 IIRC..
25th August 2009, 11:02 AM #14
Sorry to dig this one up, but has anyone actually got the separate 2008 Password Policies working? I'm trying to set my staff to change every 30 days (to meet LEA policy and my new AUP which was based on the LEA guidelines), and then want to have students at every 90 days (more due to us being short staffed so it will reduce the forgotten password calls about students). I've tried in a few places on 2008 to set them separate but no joy it only looks at the domain one, which I've set to 0 days etc thinking that would get over-ridden by the individual ones. I've enforced the policy but still no difference.
Any thoughts, google seems to be throwing blanks and useless-ness at me and I dind't find anything coming up on here apart from lots of us saying its possible.
By Jamie_a in forum Windows
Last Post: 17th December 2007, 04:20 PM
By Ben_Stanton in forum Windows
Last Post: 20th September 2007, 11:18 AM
By BKGarry in forum Windows
Last Post: 11th August 2007, 10:45 PM
Last Post: 11th January 2007, 05:00 PM
Last Post: 12th November 2006, 03:02 PM
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)