Password Complexity for different OU's

[fairm010]

I need some help setting up password complexity for different OU's, does anyone do this and can pass on any knowledge of how its done?

 

EDIT: We have all Win 7 pro client and a mix of Server 2012 & 2008 dc's.

 

Cheers

[Michael]

So long as you have a 2008 DC with the domain/forest functional levels also at 2008, you can set passwords per OU.

 

Computer Config > Windows Settings > Security Settings > Account Policies > Password Policy

 

Change this to your requirements per OU.

[fairm010]

Awesome! I didn't realise it would be this simple! Cheers Michael.

[plexer]

Didn't think it worked even if you set that at OU level.

 

We do it with fine grained password policies:

 

Creating Fine Grained Password Policies - Brandon LawsonBrandon Lawson - My Life as a IT Professional

 

Ben

[fairm010]

That looks a bit more complicated. Hmmm..

[ADMaster]

I second @plexer I don't think setting a password policy anywhere but the default domain policy has any effect. You'll need to setup a fine grained password policy.

 

Once it is setup, it's not difficult to manage. I don't assign it to an OU but a security group. Add all the younger years to a group and assign a weak password policy, all the staff probably have a group already, assign a stronger password to them.

 

Thanks,

[fairm010]

I'll do that, thanks!

[Mustang]

As stated above that setting doesn't work, That setting will only effect local account polices on servers and workstations.

 

Fine grained password policies are the only way to do what you require but as stated works on security group not ou.

Using adsi edit to do it is fairly simple but could be dangerous if you change the wrong thing. It is even easier using the admin tools in windows 8, 8.1, 2012 and 2012 r2. If you aren't licensed for any of these just download a trial version, once up and running use the Active Directory Admin Centre to create the password policy

 

Creating fine grained password policies through GUI Windows server 2012

[fairm010]

Cheers Mustang. As I said, I have 2 2012 DC's so shouldn't be a problem.

 

Cheers everyone, i'll sort this out tomorrow and post my results!

 

matt

[SkreeM1980]

Cheers Mustang. As I said, I have 2 2012 DC's so shouldn't be a problem.

 

Cheers everyone, i'll sort this out tomorrow and post my results!

 

matt

 

How did you get on with this? is on my job list for next week

[TheScarfedOne]

As stated above that setting doesn't work, That setting will only effect local account polices on servers and workstations.

 

Fine grained password policies are the only way to do what you require but as stated works on security group not ou.

Using adsi edit to do it is fairly simple but could be dangerous if you change the wrong thing. It is even easier using the admin tools in windows 8, 8.1, 2012 and 2012 r2. If you aren't licensed for any of these just download a trial version, once up and running use the Active Directory Admin Centre to create the password policy

 

Creating fine grained password policies through GUI Windows server 2012

 

This was the post that Ive used to do it recently. Much easier than the old 2008 FGPP was.