Setting up the Password Policy on domain.

[tosca925]

I am about to implement a password policy on our domain. We have never been really too strict about this before but we have had on or two situations where we need to do something about it now. The main reason for this is to get staff to change their password every half tem (ish) but not affect the pupils. I know that their can only be on password policy per domain so I need to check this before I implement it.

I intend to

1. Set the minimum password length to 8 characters (any combination of numbers, letters etc)
2. Set it Enforce Password History to 20
3. Set maximum password age to 35 days
4. Set the minimum password age to 35 days (don’t want them to be able to change it before the password expires)

Passwords must meet complexity requirements & store passwords using reversible encryption will not be used.

Now, to double check, if I set all users on our domain (except staff) so that passwords do not expire will this over ride the domain password policy? I do not want a situation where this policy can affect the kids as this would be a nightmare and the kids would be up in our office requesting forgotten passwords all the while.

If I am thinking correctly then, domain password policy will only force the setting s on staff users whose passwords are NOT set to never expire?

[Geoff]

The password policy will be enforced the next time a user changes his or her password (or has it changed for them by an administrator). Additionally, any new accounts will have this policy applied to them on creation.

[tosca925]

But what is the setting in the ADUC of their accounts has the option ticked for password not to expire?

We do not let anyone change passwords but themsleves they have to come to us. We have run the odd script on a OU to force all users to chage password at next logon but very rarely.

[tosca925]

Any ideas Geoff?

[Geoff]

Like I said, if they never change their password the new password policy will not be applied.

[tosca925]

Thanks Geoff,

i was haunted by the fact that the kids passwords would all expire.

I'll have to remember this when i add all the new year 7's