Account Policies - Group Policies in AD 2000/2003

Hi tech2010,

Password policies are applied at domain level in Windows 2003. If you apply them at OU level, they might affect only local user accounts.

HTH

Toni

if that is the case then why previously we were getting password change reminder after every 30 days even the policy was not defined at domain level, thats why i am thinking is it the case that some of the polices does work on OU level but certain policies are on the domain level?

Also i have not taken out password policy off from the domain and OU but still applying to the users, why? is it taking time to take off from the system?

As per the above two comments, 2003 account policies have to be linked at the domain level. Typically in the Default Domain Policy.

Domain controllers are hard-coded to read their account polices at the domain level. As these account policies are linked at the domain, and as such affect all machines in the domain, the result is that the same policy applies to domain accounts, and all local accounts on each machine.

You can set local account policies at the OU level, but remember that it's a computer config policy, and has to affect the domain controller machines to affect domain users. Linking to an OU holding computers will only affect the local account policies of those computers, not the domain accounts.

Tony

With regards to why the account policy is still applying, I have a feeling that Account Policies tattoo. That is, even when you remove them from the GPO, they remain as part of the local policy on the affected machines.

That would be your DCs in this case. Check gpedit.msc on a DC, check the account policies set here.

... indeed - removing a policy is not enough - if you want to chnage a setting you have to apply the change.

Just tested this to confirm and it is correct - account policies tattoo. So if you simply remove the GPO, the settings will still remain (or similarly if you set to 'Not Defined' they will remain).

Either configure the policies how you want them on a domain-linked GPO, or alternatly, edit the local policy of your DC(s).

Tony

Hi BluntTony, great thanks for clearify this. In IT we learn everyday.

So account policies tattoo means that they remains effected unless applied different settings.

That explains why it was not letting us to change local admin password on some fn the user's machine because of the policies were effecting local accounts on the machines.

So as you said that it remember the account policies lastly applied so it has to be applied with different settings if need to remove the settings, and on the domain level. Probably because now the policies has applied so may be we wont want to change the behaviour. But that still does not explain why we were getting password change reminder before, Oh might be because of was defined on domain controller.

The worst part which happened after i placed the policy on domain level on friday (just before weekend) then on Monday morning most of the users or all users were get prompted to change password immediately even though they did not reach 30 days expire period. Because users were not aware of complexity password criteria then get locked after 3 wrong attempts.

Tony, so at the moment there is no account policies linked on the domain level and it has applied becuase of it remebers the last applied settings. Can i ask you if i just now link the same policy again on to domain level. will not again prompt everyone to change their password? (even if i keep the same settings as before under account policies)