AD Password Policy oddity

[_techie_]

Hi.

 

I am experiencing an odd password policy issue at the new school I am working at.

Group Policy on the domain and domain controllers, shows that we currently have the following:

I know, I know, this is on the Default Domain policy, which shouldn't be altered, but hey ho.

On our O365 tentant we also have our password policy set to match with no expiring passwords.

 

Looking up any user on the on-premise domain, using net user %user% /domain shows that there is no password expiry (Password Expires: Never), however I am getting reports that users cannot login to on-premise systems such as SIMS, and printers.

Checking the above, I get the users password expiry, but this doesn't seem to be working correctly.

On Azure AD, in the user sign in logs, I am seeing that Windows sign in is showing as interrupted. Looking deeper into the specifc log for the user who has reported the issue, it shows the password has expired.

 

Any ideas? We are running a mixed environment of Intune/Azure AD joined machines and On-premise machines, until Easter, when we will complete the rest of the on-premise stuff over to InTune.

I can only think that this is some kind of weird password policy issue on the endpoint from an on-premise legacy setting, as this doesn't seem to add up.

 

Thanks

Edited April 4, 2022 by _techie_

[RLR]

Is it possible you might have fine grained passwords setup in Active Directory Administrative Centre? (https://activedirectorypro.com/create-fine-grained-password-policies/)

[_techie_]

Thanks for this, most helpful. Wasn't even aware you could do this.

I'll do some digging tomorrow.

Cheers

[_techie_]

Thanks, this answered my question perfectly! We have Pupils, Teachers, SLG and Tech admins.

All slightly different.

Now how to replicate this in Azure AD.... Challenge number 2!

Thanks

Mark

[robyholmes]

Look at using azure password protection rather than setting harder requirements for staff. Works really well and isn't to difficult to setup on onsite DCs.

 

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad

[_techie_]

@robyholmes

How are you dealing with Students in this scenario with Azure?

Quite a few students don't have suitable devices for use with Microsoft Authenticator, and or we can't easily register them for SMS text auth.

We also have conditional access in place to stop MFA being triggered when on-site at the school.

In terms of AD, we have AD connect setup for pass-through authentication.

 

A lot of the kit being used by students still has just keyboard entry, so we are stuck with using usernames and passwords, for the time being anyway.

Just trying to minimise being swamped by masses of students with password resets anyway.

 

Thanks for any pointers you can give.

Regards

[gaz350b]

The password protection has nothing to do with mfa. You can also use it on your local AD servers to apply additional rules.

[robyholmes]

@robyholmes

How are you dealing with Students in this scenario with Azure?

Quite a few students don't have suitable devices for use with Microsoft Authenticator, and or we can't easily register them for SMS text auth.

We also have conditional access in place to stop MFA being triggered when on-site at the school.

In terms of AD, we have AD connect setup for pass-through authentication.

 

A lot of the kit being used by students still has just keyboard entry, so we are stuck with using usernames and passwords, for the time being anyway.

Just trying to minimise being swamped by masses of students with password resets anyway.

 

Thanks for any pointers you can give.

Regards

 

As @gaz350b said, password protection isn't MFA/2FA. It's just a system of checking passwords against a common list of 'easy' passwords, plus it stops students using there name for example. You can also add your own blocked words such as the school name. If they replace a O with a 0, it can still block it as well if the password is still easy to guess.

 

For us, it meant we could remove the complex requirement for staff and students which caused some of our SEN students a lot of problems. It works both in Azure AD (In fact I think it's already active on that) and can be installed on your local servers to protect them too. If your syncing passwords to Azure AD this means both ends are covered and you can enable password write back.

 

Another system to look at is Self Password Reset, just be aware once enabled, all Office 365 are asked for authentication methods or security questions. We used this a lot during lockdown so students (And some staff) could reset there password without having to contact IT.