Password policies

[Sheridan]

I'm implementing fine grained password policies and cannot find a definitive answer for one of my questions, which is 'when does the FGPP take effect'. For example, if I have a domain policy that dictates a 10 char password and implement a FGPP for a group of users that enforces 12 characters/complex, does that mean the users have to change on their next login, or does this only take effect when they change their passwords themselves?

 

With a large number of users being involved I want to leave the old domain policy in place, add a new FGPP to a group (that has 1000's users) and then in chunks set those users to 'change password on next login' to implement this. Would that work, or would all members of that group be forced to change their password as soon as the policy was assigned to their group?

[pete]

Only when they're prompted to change the password through some other event (choice, expiry timer, admin ticking the "you need to change your password at next login" box in AD)

 

If Bob's password is 10 characters currently, he'll need to use a new complex 12 character password only when he next chooses a new password.

[Sheridan]

Only when they're prompted to change the password through some other event (choice, expiry timer, admin ticking the "you need to change your password at next login" box in AD)

 

If Bob's password is 10 characters currently, he'll need to use a new complex 12 character password only when he next chooses a new password.

 

Thanks, that's what I've been working on, but haven't managed to find it clarified anywhere by MS!