Windows 2008 Granular Password Policies
Closed     Case # 10033     Affiliated Job:  New Trier Township District 2031
Opened:  Monday, April 26, 2010     Closed:  Friday, April 30, 2010
Total Hit Count:  39039     Last Hit:  Tuesday, October 3, 2023 2:52:02 AM
Unique Hit Count:  6771     Last Unique Hit:  Tuesday, October 3, 2023 2:52:02 AM
Case Type(s):  Server, Network
Case Notes(s):  All cases are posted for review purposes only. Any implementations should be performed at your own risk.

In our environment we wanted to establish multiple password polices; students, technology and staff. A Windows 2008 Native environment allows for just this.

Action(s) Performed:
Total Action(s): 4
Action # Recorded Date Type Hit(s) User Expand Details
10137 5/10/2010 11:47:22 AM Server 2757 OWA Password Expiry Banner Some limitations to the Exchange 2007   More ...
10138 5/10/2010 11:47:22 AM Server 2940 Exchange 2007 Password Expiry Notification Email Requires: Quest   More ...
10136 5/10/2010 11:47:22 AM Server 2723 Applying the Proper Domain Structure to Password Policies It came  Collapse ...
Last Hit: Monday, October 2, 2023 10:56:57 PM

Applying the Proper Domain Structure to Password Policies

It came to our attention that blocking the root from inheriting to the "Domain Controllers" container caused the password polices to be unable to take effect. If you find the password policies are incorrect, simply deny the "Apply Group Policy" permission on any root Group Policies [Which should not affect the Domain Controller] for the "Enterprise Domain Controllers" & "Domain Controllers" groups, unblock the Domain Controller container and the password settings will become effective. We found the granular PSOs were applying, but the Default Domain password policy were not. While having the Domain Controllers container blocked from root inheritance, we also noticed a strange outcome - the message, regardless if a user was using a granular PSO or the Default Domain password conditions, the message returned always indicated "6 password length, 24 password history & 0 password age." The difference was despite this error - users assigned a granular PSO observed the conditions set in the PSO and any user assigned the Default Domain ignored the settings in the Default Domain policy and used these basic settings.
10120 5/3/2010 1:32:09 PM Server 2757 Review the assigned password policy to a user: Quest has a great  More ...

After removing our last Windows 2003 DC and promoting our environment to Windows 2008 Native (Both domain [A.D. Users and Computers] & forest [A.D. Domain and Trusts] levels, as we are a single domain), establishing multiple policies was relatively easy.
-   Some useful URLs are:
   o   []
   o   []
-   Create "Global" - "Security" groups and assign your members
   o   i.e. "All Students", "Technology Staff" & "All Staff," you may use existing groups and group nesting is allowed (i.e. A student in "Grade 09" nested in "All Students" will receive the password policy assigned to "All Students," assuming the precedence setting sets it as priority). A precedence setting, mentioned below, will determine which policy is actually applied when multiple policies are affiliated to a user.
-   Set, review and confirm your default password policies in the "Default Domain Policy," when a user is not affiliated to a security group assigned one of the granular password policies, they will default to the "Default Domain Policy."
-   Create your new password policies using ADSI editor
   o   Open your "Default naming context []"
   o   Expand "DC=yourdomain,DC=com" - "CN=System" - "CN=Password Settings Container"
   o   Right click on "CN=Password Settings Container" & select "New" - "Object"
   o   Select the only class present "msDS-PasswordSettings" and click "Next"
   o   The following will be a "Wizard" to set up the initial parameters of the password policy
          - Common-Name (CN) | Whatever you want to call the new policy
          - msDS-PasswordSettingPrecedence | The lower the cost level, the higher the priority
                + i.e. A policy with 10 will beat another policy assigned to the same user that has a cost of 20
          - msDS-PasswordReversibleEncryptionEnabled | Generally "False"
                + Storing passwords in reversible encryption is like storing passwords in clear text, but is sometimes required for some third party apps
          - msDS-PasswordHistoryLength | How many passwords to remember? i.e. a setting of 5 would be the last 5 passwords used are not permitted
          - msDS-PasswordComplexityEnabled | Up to you "True" or "False" - will require a password with at least one attribute from at least three of the following areas
                + Lower-Case
                + Upper-Case
                + Numerical 0 through 9
                + Special Character like !@#$%
          - msDS-MinimumPasswordLength | A setting of 8 would require the password be at least 8 characters long
          - msDS-MinimumPasswordAge | If you change your password now, how long are you required to wait before you can change it again
                + A value of "-864000000000" would equal a 1 day wait before you could change your password again
                + A value of "0" will set this to "None"
          - msDS-MaximumPasswordAge | How long until you will be required to change your password again
                + Using the above value for 1 day "-864000000000" & multiplying it by the # of days. i.e. "-864000000000" * 30 days = "-25920000000000"
                + A value of "-9223372036854775808" will set this to "Never" - you cannot set this to "None" or "0"
          - msDS-LockoutThreshold | How many failed attempts before locking an account - i.e. "5" continuous failed password attempts will lock the account
          - msDS-LockoutObservationWindow | How long before the reset of the counter for a failed password attempt
                + i.e. 10 minutes would be "-6000000000"
                + A value of "0" will set this to "None"
          - msDS-LockoutDuration | How long before the account will automatically unlock itself
                + i.e. 30 minutes would be "-18000000000"
                + A value of "0" will set this to "None"
   o   Click finish to create your policy and then right click it and select properties
   o   Click "Filter" and ensure that "Show only attributes that have values" is unchecked
   o   Look for the attribute "msDS-PSOAppliesTo" - this attribute is used to link the password policy to the security group it will apply to, edit the properties of this item and "Add Windows Account" search out your affiliated Global/Security group and add it to the list
   o   Review the other attributes set in the wizard, note that instead of those negative numbers mentioned above for the durations, you will now see them as dd:hh:mm:ss, I find it is easier to just type some random negative number during the wizard and then follow-up with the exact time after in the policy properties

Profile IMG: Footer Left Profile IMG: Footer Right