Group Policy Password Complexity Question

[Sam_Brown]

Looking to change our password policy to force students and staff alike to have 8 characters in their username. Thought I'd test it out on a test OU but creating a GPO and assigning it to the test OU doesn't seem to enforce it. I can set other settings and they apply but not the password policy.

 

Are there special considerations when using GPO to set password complexity on OUs?

 

Also I see that it's a computer policy... if I say wanted to force students to have one set of rules and staff another then I assume that I would need to enable loop back processing and assign it to a USER OU?

 

Cheers,

[fiza]

I haven't done this myself but I was under the impression you had to set the policy to a security group not an OU.

[tmcd35]

AFAIK this policy can only be set in the Default Domain Policy.

[rob_coles]

Product Documentation | Specops Password Policy Basic

[Norphy]

Assuming that your domain is running at Windows 2008 level or above, you can set fine grained password policies.

 

You set them on groups rather than OUs and it's not especially simple to do

 

AD DS: Fine-Grained Password Policies

[fairm010]

I use fine grained password policies assigned to security groups on Windows Server 2012 domain.

[edutech4schools]

As above.

 

I have fine grained passwords setup at all my schools. Works much better than the standard password rules but is more complex to setup.

[Sam_Brown]

Thought I'd give it a bash and no issues until it came to finish off creating the Password Object. I'm getting an error something along the lines of:

 

Operation failed. error code: 0x20e7

The modification was not permitted for security reasons.

000020E7Tongue TiedvcErr: DSID-03050681,problem 5003

(WILL_NOT_PERFORM),data 0

 

I've tried the usual of looking through MS and Google but can't find an easy fix. Has anyone who has used Fine Grained Password has this error before at all?