Ok, something we are just about to implement - Password Policies for Staff. However, I hear you cry, you can only have one policy per domain - the "Default Domain Policy GPO". Yes - pre Server 2008 that is true...

With Windows Server 2008 you will now be able to define different password account lockout policies within the same domain. Previously this was not possible and this was also one of the reasons many of our customers implemented multiple domains in their forest. With Fine-Grained Password Policies you can assign different policies to users (individually if you want) or groups.

Its in there, but minus a GUI to configure this and you need to use the ADSIedit to create, manage and set the password policies. This is a bit of a pain, as its not the most friendly of beasts - and a licence to break things if you arent careful. If you want to go play the ADSI way, Kurt Roggen has blogged on it HERE.

Me on the other hand, would rather not. There are some community released nifty tools where you can manage the policies through a GUI, command-line or even by using PowerShell.

Some of the best...

Christoffer Andersson's Fine Grained Password Policy Tool (inc some Powershell snap ins)

http://blogs.chrisse.se/blogs/chrisse/archive/2009/01/11/fine-grain-password-policy-tool-1-0-2300-0-rtm.aspx

Dmitry Sotnikov's Fine Grained Password Policies POWERGUI

http://dmitrysotnikov.wordpress.com/2007/06/19/free-ui-console-for-fine-grained-password-policies/

Joe Richards (MVP) PSOMgr

http://www.joeware.net/freetools/tools/psomgr/index.htm

Enjoy!