GPO Massive Problem!

[blu4]

Hi everyone!

 

First post here- nice to know there is a community to help! Now, off to the question- we have a Windows 2008 R2 running GPO. Three policies are in place- default domain, staff and pupil policy. The problem occurs when we try to change the passwords. The option which lies in Computer Configuration (Enabled)-->Policies-->Windows Settings-->Security Settings-->Account Policies/Password Policy "Password must meet complexity requirements". It's disabled in every policy but the system still moans when we try to change passwords in AD for students to something like "1234". According to this stupid policy, the password has to be 8 characters long, have a capital and a number. We are having organisational issues with this since every lesson Year 7, 8, 9 come up and want their passwords reset. We cannot do any password we like even for staff and IT support. I have spent hours staring into the settings and I cannot figure out what is wrong with this.

 

PS. This is my first job as a System admin (I'm fresh from University) and I'm using GPO for the first time too.

 

Any help or advice would be greatly appreciated.

 

Thanks!

[plexer]

It may not be set there look for fine grained password policy.

 

Ben

[plexer]

Windows Server 2008 - Fine Grained Password Policy Walkthrough - The Sean Blog - Site Home - TechNet Blogs

 

Ben

[blu4]

Looks promising, thanks a lot for sharing. I will give this a try and report back.

 

Cheers

[victory2012]

check your gpo assigned to domain controllers?

[IrritableTech]

Have you done a gpupdate on the server and a client to ensure they both use the latest version?

On your client try running gpresult /R is the policy being run by the client?

[TechSupp]

Slightly jumping onto this thread but still relevant, if a setting is changed in GPO should gpupdate be run on server and client or is just running it on the client enough?

[sted]

Slightly jumping onto this thread but still relevant, if a setting is changed in GPO should gpupdate be run on server and client or is just running it on the client enough?

 

depends what the setting is if it dosent really affect the server than theres not much point (say a software deploy policy or a user policy not applied to admins)

[blu4]

Windows Server 2008 - Fine Grained Password Policy Walkthrough - The Sean Blog - Site Home - TechNet Blogs

Ben

Unfortunately, it does not work. Can't find the settings at all.

 

check your gpo assigned to domain controllers?

Yep, they are assigned.

 

Have you done a gpupdate on the server and a client to ensure they both use the latest version?

On your client try running gpresult /R is the policy being run by the client?

First thing I've done.

 

Also after changing all policy settings I always do gpupdate /force.

[CyberDrac]

Have you tried a RSoP (Resultant Set of Policies) on the user and machine to see what is being applied and from where?

[plexer]

Ok so you say you've disabled the domain wide password policy but have you tried setting it to something less restrictive and applying that instead?

 

Ben

[witch]

Have you tried creating a policy specifically for passwords? We couldn't find out where the complexity was set but a new policy overrode the settings - wherever they were

[Roberto]

Slightly jumping onto this thread but still relevant, if a setting is changed in GPO should gpupdate be run on server and client or is just running it on the client enough?

 

It should be run on the target for the settings you're testing/trying to apply. E.G. if you're changing workstation settings you don't need to run it on your servers. If you're just changing a server setting you do need to run it on your servers, but you don't need to run it on your workstations.

[Roberto]

Unfortunately, it does not work. Can't find the settings at all.

 

This suggests that your domain functional level hasn't been raised. You need to upgrade the domain functional level to W2008 level before fine-grained passwords are usable.

[sted]

This suggests that your domain functional level hasn't been raised. You need to upgrade the domain functional level to W2008 level before fine-grained passwords are usable.

 

just make sure you havnt got any 2008r1/2003 domain controllers before you do

[Roberto]

just make sure you havnt got any 2008r1/2003 domain controllers before you do

 

Quite right! I was kinda taking that as read, but given the gravity of taking that step it isn't a bad idea to emphasise this.

[Mustang]

The settings in your staff and student policies for passwords would NOT effect network users. These settings only effect local accounts on the workstations/servers so setting anything at this level is pointless, you need to be looking at your default domain policy or maybe someone has already setup Fine Grained Passwords.

 

Logon onto a workstation and run "net accounts /domain" from the command line, does the output match your default domain policy??

[woodham]

might sound daft but password complexity and password length are two separate settings .

 

default I believe is 8 but can be changed if you havnt altered this then it's not going to accept 1234 as its too short

 

its under computer config>windows settings>security settings>account policies/password policy

 

 

hope that helps

[blu4]

Quite right! I was kinda taking that as read, but given the gravity of taking that step it isn't a bad idea to emphasise this.

 

The settings in your staff and student policies for passwords would NOT effect network users. These settings only effect local accounts on the workstations/servers so setting anything at this level is pointless, you need to be looking at your default domain policy or maybe someone has already setup Fine Grained Passwords.

 

Logon onto a workstation and run "net accounts /domain" from the command line, does the output match your default domain policy??

 

might sound daft but password complexity and password length are two separate settings .

 

default I believe is 8 but can be changed if you havnt altered this then it's not going to accept 1234 as its too short

 

its under computer config>windows settings>security settings>account policies/password policy

 

 

hope that helps

 

Thanks for all the suggestions however, I tried all the things you mentioned along with the fine grained policy which I could not get to work. The thing about this problem is that is suddenly started occuring! One day it was fine and the other day it just refused to do anything :< I guess the only solutions is to do the GPO from ground up...

[machin05]

Your password complexity requirements have to be set in the Deafult Domain Policy, don't they?

[ZeroHour]

Could you possibly take a picture of your OU structure and where things are sitting, aka user accounts in one, pc's in 2 and domain controllers in another?

[Mustang]

So did the output of "net accounts /domain" match any of your group polices

 

You can't just do your GPO from the ground up, "Default Domain" and "Default Domain Controllers" are special policies and should NOT be unlinked or ideally edited.

There is a tool to reset them to a basic state but you need to know what your doing and what will be changed.

[Roberto]

Your password complexity requirements have to be set in the Deafult Domain Policy, don't they?

 

Not sure that they have to be set in that specific GPO, but to be applied to the domain they need to be set in a GPO that is then applied to the domain itself - the Default Domain Policy certainly meets that description (IIRC), but I personally think there's a lot to be said for not changing that or the Default Domain Controllers policy at all, and instead creating a duplicate of the one you're hoping to edit to contain your changes at this level.

 

This is one level where you don't want it to be any harder than it has to be to roll changes back if you make a mistake.

Edited September 29, 2014 by Roberto

[detjo]

Might be worth checking the local group policy (gpedit.msc) on the Domain controller to see if it's still set there. Domain policies 'should' override this, but I've seen local policy play silly buggers before.

 

As already pointed out, create a new domain wide policy and use that instead of editing default domain policy.

[itgeek]

I would create a test OU and put yourself in there. I would also (not recommend block inheritance on this OU) Then apply the password policy. Give that a try.