Fine-Grained Passwords..

[kartious]

Hello All

 

 

 

I have been asked to set up fine-grained passwords on our primary domain controller. I first off created a global security group called "AdminPSO" which contains a small set of users from a OU, I then have a DSquery script which takes the users from that OU and adds them to the group.

 

Note. We do not have any other password policies on the network.

 

I have then created the new PSO (called APSO) in the password setting container on ANSI Edit with the following configuration:

Precedence: 1

Reverse Encryption Enabled: False

Password History Length: remember 4 previous passwords

Complex Passwords: True

Minimum Password Length: 5 characters

Minimum Password Age: (none)

Max Password Age: 10 minutes (0:00:10:00) (Testing purposes, will be 90 days when applied to the users)

Lockout Threshold: 5 attempts

Observation Window: 2 minutes (0:00:02:00)

Lockout Duration: 5 minutes (0:00:05:00)

 

 

I then amended in the attribute editor which the PSO applies to which I can confirm which I have pointed towards the AdminPSO group. After running DSquery script and confirming all the users are getting input into the AdminPSO group I then check the ResultantPSO attribute on one of the users in the AdminPSO group which states that the APSO is in the value field.

 

Not sure If I am missing anything out here but after having set all that up the users only some of the settings from the PSO seems to apply. For example the users are now enforced to create a secure password & they can now lock themselves out with too many incorrect attempts... but the users are never enforced to change their passwords after the time period expires.

 

An example would be here is that I have had the maximum password age set to 1 day which I have put into action around 9 am. The next day around 12pm I attempt to log into the user in hope that the password has expired.. which never happens.

 

Can anyone shed some light on this? As I am unsure what to do at this point.

Edited February 25, 2015 by kartious

[Killer_Bot]

I suspect this is a no but just in case; you haven't gotten the account set to 'password never expires' have you?

[kartious]

You know... this was exactly it, all I have done from here is created a small script with dsquery to apply this change to all users in those specfic OUs.

 

Thanks