We had Password Policy and Account Lockout Policy defined under computer configuations as below on one of the OU in AD.

Account Policies/Password Policy:
                Enforce password history: 12 passwords remembered
                Maximum password age: 30 days
                Minumum password age: 29 days
                Minumum password length: 8 characters
                Password must meet complexity requirement: Enabled

Account Policies/Account Lockout Policy:
                 Account Lockout duration: 60 minutes
                 Account Lockout threshold: 3 invalid logon attempts
                 Reset account lockout counter after: 60 minutes

But i had noticed that it was applying half of the policy, "account lockout threshold" , "Minimum Password length" and "Password complexity requirements" etc..was not applying to the users. Is this possible?

So i did bit of googling and found that these password policy is the domain level policy and has to be set on domain level. So i removed the link of the plicy from that OU and added into domain level. After a day or two we noticed that it immediately prompted users to changed their passwords and it has forced them to use complexity requirement and also it locked the account after 3 invalid attempts. Because users were not aware of the complexity requirements so it locked them out. It was terrible morning today because we had lot of users calls.

So i then immediately taken off that policy from the domain level and from that OU. but it still seems that that policy is still effective. Someone how password complexicty still in place and when users prompted they has to use complexcity password. It is very strange.

I have gone through on all the OUs and this policy is not defined anywhere but still applying. do you know why?

Also please explain is it policy half of the policy can be applied or not? please explain which of the setting works on domain level and what setting works on OU level? thanks.