Password Complexity for Staff Only

[_techie_]

Hi,

 

We have moved over to Windows 7 this summer, all is going pretty well, but I am struggling a little with password complexity at the moment.

We would like to have staff to have more complex passwords, but with 1700 pupils, this is going to be a mess, and I don't really want to hold lessons up getting Year 7's to have complex passwords just yet!

 

I am at the current stage of just getting passwords to be able to be changed regularly at the moment, with no complexity requirements, but keep hitting the this 'password does not meet length, time or complexity requirements on this domain' error message.

 

I have set the password policy on both our domain controller servers and workstations to be the same but still no luck and is as follows:

 

1) Enforce Password history - 0 passwords remembered

2) Maximum Password Age - 0 days

3) Minimum Password Age - 0 days

4) Minimum password length - 0 characters

5) Passwords must meet complexity requirements - Disabled

6) Store passwords using reversible encryption

 

Am I having problems because of the 0 chars password length limit?

 

 

I have seen Angry Technicians post on his website about the specops tool, which looks interesting, but what have others set as the password policy on the workstations/servers/domain and where have you put this in your policy setup?

 

Thanks

_techie_

[elsiegee40]

Where are you setting the GPO and is your network operating at Server 2008 level?

 

Under Server 2003 it could only be done at the highest level, so it's not possible to have different policies.

 

Server 2008 you put the policy at OU level.. always making sure that a higher level policy does not contradict it.

[_techie_]

We are at 2003 level I think, but will double check...

Thanks for the input.

Will get back to you in a bit...

[_techie_]

Yes we are at 2003 level. Just went through everything and we have a slight problem in that we have inheritance blocked on our new windows 7 structure, to prevent any old policies from XP filtering down. I have double checked everything and have now cleaned this up. However, the default domain policy does not look like as expected and looks like it has been modified - great! more mess to clean up!

 

Seems we have some more work to do!

 

Will report back in a bit!

[plexer]

Unless on 2008 you can only have 1 password policy per domain.

 

Ben