password complexity help

[timbo343]

We are trying to enforce password complexity into our domain but dont want to enforce it for pupils. Looking and testing the settings on the servers, it looks like it can only be done at domain level not OU level. Is there a way we can configure this per OU? It can be done via password filtering but it means eidting the registry on each DC and i dont particually want do that. is there an easier way?

 

Thanks in advance

 

Tim

[Gatt]

Unfortunately - No

 

Password Policies are set at the domain level and only take effect in the Default Domain Policy.

 

Only solution would be seperate domains for pupils and staff..

[ajbritton]

Unfortunately - No

 

Password Policies are set at the domain level and only take effect in the Default Domain Policy.

 

Only solution would be seperate domains for pupils and staff..

 

Be careful how loud you say that... hang on... what's that noise ... oh no! ... here they come... IT'S THE YOU MUST USE A SINGLE DOMAIN gang.....

[Norphy]

My last place used multiple domains for precisely this reason. And about a month after I set that up, I found about this.

 

I swore.

[ajbritton]

Did you find out how much it costs?

[Norphy]

No but I suspect it's not cheap.

[ajbritton]

That would be my guess as well. Unless of course they do academic pricing.

[plexer]

Well I'll found out when they get back to me.

 

Ben

[Gatt]

Shame, cos their GPUpdate tools were great - espcially with them being free and all..

[Kyle]

Easy Solution here.

 

Set the Policy,

Got to a OU with Pupils

Select all of them, then right click properties,

choose password never expires.

 

This will stop the pupils passwords ever expiring. Do this for all pupils/users you don't want passwords expiring for.

 

I have used this successfully before.

 

You can still go in a change the password for them or use a script to force users from a certain OU choose a different password at next log on.

[FN-GM]

Easy Solution here.

 

Set the Policy,

Got to a OU with Pupils

Select all of them, then right click properties,

choose password never expires.

 

This will stop the pupils passwords ever expiring. Do this for all pupils/users you don't want passwords expiring for.

 

I have used this successfully before.

 

You can still go in a change the password for them or use a script to force users from a certain OU choose a different password at next log on.

 

He doesn't want the users passwords not to expire he wants to set a policy on certain users on how complex there passwords are

[ajbritton]

Easy Solution here.

 

Set the Policy,

Got to a OU with Pupils

Select all of them, then right click properties,

choose password never expires.

 

This will stop the pupils passwords ever expiring. Do this for all pupils/users you don't want passwords expiring for.

 

I have used this successfully before.

 

You can still go in a change the password for them or use a script to force users from a certain OU choose a different password at next log on.

 

This will work if you change the passwords manually via DSA.MSC, but if you configure the 'force password change' attribute, then the password policy will be applied.

[plexer]

For 850 users in 1 AD domain the price is:

 

£1461.25

 

2nd and 3rd maintenance combined is £500

 

Ben

[PiqueABoo]

the price is:

 

OUCH!

 

I did a password filter a long time ago (as usual) which tested them against a memory mapped dictionary file and definitely wasn't hard.

 

Multiple password policies is more complex because you need to need get hold of an OU or group membership from an account name in order to pick and test their proposed password against the right policy. That means talking to AD and in this context I'm currently not sure which of several userland approaches to that might work or be be safe, but it can't be that hard!

 

Anyway at that price I'd probably hold fire on a solution now and start considering whether it might be an idea to just upgrade DCs to Server 2008 next summer.

 

Well not me personally, I'm actually wondering whether to have a quick look at this and knock one out at a bargain basement price.

[mrcrazy04]

If you got an open source GINA dll, then you could integrate it into that to do the lookups and apply the relevant policy - and then it isn't running in userland.

[ajbritton]

I've note tried it, but Password Filter DLL looks like it might be of use. It's a generic Password Filter that calls a user definable script on password change events. It should be a simple matter to look up the username in AD, check the OU the user is in and... well, you can guess the rest.

[Michael]

I believe Windows Server 2008 will allow password complexity policies to be set at OU level and not just domain level.

 

I don't think setting up two domains justifies the time just for password complexity policies. It'd be much better to compromise such settings to cater for all users.

[Geoff]

As an alternative, I run Rainbowcrack with Rainbow tables against my DC weekly for 3 hours. If an accounts password gets broken within that time limit, then the 'change password at next login' account attribute is flagged. Shoddy passwords are broken rather quickly. It's so easy it's not funny.

[PiqueABoo]

I run Rainbowcrack with Rainbow tables against my DC

 

If BadGuy is in a position to do that it's already <>

 

But I suppose it does help train your users in good habits they might apply elsewhere.