Domain password settings, but only for the staff.

[edutech4schools]

Just helping out at a primary school and I noticed all the staff are using very silly passwords. The head has given me the OK to make sure all the staff are forced to change their passwords to something more secure, but has asked me to make sure the passwords are not altered for any pupils.

 

I think the normal way of changing a password is to change the 'Computer'....... gpo but I assume this is not an option as on occasion a staff member might need to log onto a curriculum laptop and that would then apply the password policy to the pupils that use it.

 

I seem to remember getting the password policies to apply years ago using password complexity or something but this seems to have all changed with Windows 2012r2.

 

Does anyone have any ideas how I can get the staff to meet my password settings but not the pupils.

 

Thanks

[SHimmer45]

iirc you create a policy with your password requirements and then select which group you wish to assign the policy to

[whartomt01]

Step-by-Step Fine-Grained Password Policy in Windows 2008 - ShowMeHowToDoIt.com

[clareq]

In Server Manager go to Tools and select Active Directory Administrative Center. You can set the password policies per security group in there.

[Oaktech]

Step-by-Step Fine-Grained Password Policy in Windows 2008 - ShowMeHowToDoIt.com

 

That's how I did it... It's working very well from a security point of view, but 2 years on the staff are still monaing about it!

[whartomt01]

yeah I've done it previously at the schools request. Then taken it back off a week later, again at the schools requests.

seems to work well that way though

[edutech4schools]

Thanks. The 2008 method is the old way of doing it.

 

Think this is the new way - https://4sysops.com/archives/fine-grained-password-policy-in-windows-server-2012/

[whartomt01]

2008 still works on 2012r2.

But will give the new way a go next time, cheers for that