2012r2 Password Policies

[Steve21]

Afternoon All,

 

Not sure if I'm being a spas today, or whether things that I thought had changed haven't actually changed, but password policies!

 

Currently the default domain policy isn't used for anything and inheritance is blocked (original setting before I joined here), so I made a new password policy at a lower level for this, but some people don't seem to get it applied to them. Does this still not work even in 2012r2? Set a 90 day timer on it, and it's showing as an applied GPO to the computers, but a user is getting a 14 day warning after 16 days. (Which would be the 30 set in the Domain policy)

 

I know this never used to work pre08 but thought it was all sorted now, or do I need to look at fine grained policies under the Default Domain is unblocked?

 

Thanks,

Steve

[Sagima]

It still needs to be in default policy but you can use the fine grained password policy settings instead in ADAC Edited June 18, 2015 by Sagima
wrong terminology

[Steve21]

That's rather spassy Guess I need to go dig through the Domain Policy and see why they blocked inheritance to all OUs for it... :s

 

Thanks,

Steve

[localzuk]

This page has some useful instructions for different password policies. They've made it easier, with a UI now, rather than the schema style changes you had to make in 2008.

 

Configure multiple password policies on a single domain in Server 2012

 

You still have to have a default password policy at the top, but can use that tool to create other policies wherever you want them below that level.

[Steve21]

Hmm guess that might make more sense rather than trying to work out what bit of the DDP was blocked and for what reason Will have a flick through that!

 

Thanks,

Steve

[Firefox]

I'd still certainly looks at why the DDP was blocked. That's definitely bad practice.

 

In fact we have our DDP enforced to override any blocks