Quick Password Question Again

[mattx]

On Server 2003 - does the password policy override the 'password never expires' option [ tick box ] on the actual user account ?

I have a feeling it does but need to double check.....

[mattx]

This is what annoys me - you get conflicting reports and I can't find any simple bleeding answer on any MS page...

This chap says Group Policy Overrides:

Do the Group Policy Object and 'Password Never Expires' flag interact?

But on other pages and forums people say it does not.

 

It's a simple question but everywhere I look there is no answer - even my inside out 2003 there is no answer, I'll start on my Technet knowledge base next.....

[mrmontymick]

On Server 2003 - does the password policy override the 'password never expires' option [ tick box ] on the actual user account ?

I have a feeling it does but need to double check.....

 

No, it doesn't. Settings work from furthest to nearest, and the account settings will take precedence as it is nearest the user. Hope that makes sense....

 

For example ->

 

If you had a user in an OU heirarchy such as below it would be applied in this order:

 

Domain Default Policy ---> Staff Settings Policy ----> IT Staff Settings Policy ---> AD Account Settings

 

The AD settings for the inividual user will override group policy.

 

Regards

 

Kevin

[mattx]

No, it doesn't. Settings work from furthest to nearest, and the account settings will take precedence as it is nearest the user. Hope that makes sense....

 

For example ->

 

If you had a user in an OU heirarchy such as below it would be applied in this order:

 

Domain Default Policy ---> Staff Settings Policy ----> IT Staff Settings Policy ---> AD Account Settings

 

The AD settings for the inividual user will override group policy.

 

Regards

 

Kevin

 

Which is the way I was [ self taught ] - thanks for confirming.

[mjs_mjs]

No, it doesn't. Settings work from furthest to nearest, and the account settings will take precedence as it is nearest the user. Hope that makes sense....

 

For example ->

 

If you had a user in an OU heirarchy such as below it would be applied in this order:

 

Domain Default Policy ---> Staff Settings Policy ----> IT Staff Settings Policy ---> AD Account Settings

 

The AD settings for the inividual user will override group policy.

 

Regards

 

Kevin

 

I can confirm this as some accounts i use have passwords set not to expire at the user level, and that overrides the GPO policy.