Hello All
I have been asked to set up fine-grained passwords on our primary domain controller. I first off created a global security group called "AdminPSO" which contains a small set of users from a OU, I then have a DSquery script which takes the users from that OU and adds them to the group.
Note. We do not have any other password policies on the network.
I have then created the new PSO (called APSO) in the password setting container on ANSI Edit with the following configuration:
Precedence: 1
Reverse Encryption Enabled: False
Password History Length: remember 4 previous passwords
Complex Passwords: True
Minimum Password Length: 5 characters
Minimum Password Age: (none)
Max Password Age: 10 minutes (0:00:10:00) (Testing purposes, will be 90 days when applied to the users)
Lockout Threshold: 5 attempts
Observation Window: 2 minutes (0:00:02:00)
Lockout Duration: 5 minutes (0:00:05:00)
I then amended in the attribute editor which the PSO applies to which I can confirm which I have pointed towards the AdminPSO group. After running DSquery script and confirming all the users are getting input into the AdminPSO group I then check the ResultantPSO attribute on one of the users in the AdminPSO group which states that the APSO is in the value field.
Not sure If I am missing anything out here but after having set all that up the users only some of the settings from the PSO seems to apply. For example the users are now enforced to create a secure password & they can now lock themselves out with too many incorrect attempts... but the users are never enforced to change their passwords after the time period expires.
An example would be here is that I have had the maximum password age set to 1 day which I have put into action around 9 am. The next day around 12pm I attempt to log into the user in hope that the password has expired.. which never happens.
Can anyone shed some light on this? As I am unsure what to do at this point.
