Password Policy

[Manny-Tech]

I've inherited a network that has all the defaults set to disabled for a password policy. Recently the management has decided that they want to enforce such policies, however they want to determine when it is changed; most likely the first week of each new term.

 

My question is, can I set the complexity requirements, the length of password, old password retainment etc.. but force a manual password reset by just selecting all staff members in AD and checking the 'User must change password at next logon' when required?

 

If there's another way around it then please do suggest.

[halbaradkenafin]

My question is, can I set the complexity requirements, the length of password, old password retainment etc.. but force a manual password reset by just selecting all staff members in AD and checking the 'User must change password at next logon' when required?

 

Yes, that's possible and the process is exactly as you've described. I've done it in the past over holidays to set set passwords to never expire and then removed that box a few weeks into term (usually over the longer holidays like christmas and summer).

[elsiegee40]

Likewise. I usually force a password reset in week 2 after each major holiday.

[Oaktech]

I have a fine grained password policy for staff: Last 3 passwords remembered, 8 characters or longer and must fulfill complexity requirements. The passwords expire automatically every 60 days, but I force a change in September so everyone expires at the same time.

[mikkydoos]

Yes. Set the complexity in your Group policies with length, age, remembered etc.

 

You can either specify a maximum password age or manually force a reset as you described above.

 

Be aware of any other systems that require those AD credentials though. For example Office 365 or print management etc. They may need a manual sync.