Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Policy and blocking inheritance.

Posted on 2006-06-15
16
Medium Priority
?
409 Views
Last Modified: 2010-04-18
Hi Peeps,

I dont think this a tough one but just wanted to get a confirmation from the experts.
Basically I have a bunch of OU's and I want to set a domain policy to enforce passwords to be a certain character length.
However, I do not want to affect of of the OU's which is the server logins. I need them to be unaffected by the domain level policy.
I thought it was as simple as blocking policy inheritance on that specific OU but from reading certain things here, that is not the case.

How can I apply a domain level policy to all users, (Marketing OU, Finance OU, Developers OU, etc etc) without affecting the Servers login usernames OU.

Thanks folks,
Raf
0
Comment
Question by:dqnet
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
  • 3
  • +2
16 Comments
 
LVL 48

Assisted Solution

by:Jay_Jay70
Jay_Jay70 earned 400 total points
ID: 16910403
before you go any further with this, a password policy really should incorporate your entire domain structure - just my two cents

you can look at using security filtering if you really want users filtered out
http://www.windowsnetworking.com/articles_tutorials/Group-Policy-Security-Filtering.html

0
 
LVL 85

Accepted Solution

by:
oBdA earned 400 total points
ID: 16910408
You can't without a third party tool like Anixis's Password Policy Enforcer (http://www.anixis.com/).
You can only have one password policy per domain, and it has to be linked to the domain root; you can't apply (or block) domain password policies to OUs (password policies defined in an OU will only apply to *local* accounts on machines in that OU).

Step-by-Step Guide to Enforcing Strong Password Policies
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/strngpw.mspx
0
 
LVL 9

Expert Comment

by:vsg375
ID: 16910414
Hi,

Did you just block inheritance, or did you explicitly deny the policy on the OU ?

Cheers
0
Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

 
LVL 9

Expert Comment

by:vsg375
ID: 16910418
hmmm...was late posting that one, as usual ;o)  Jay and oBdA, your'e definitely too fast for me ;o)
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16910433
:-) just got lucky, spammed my keyboard and something legible came forth ;-)
0
 

Author Comment

by:dqnet
ID: 16911974
Hey Jay Jay!
How ya doing pal?

Ok, what about this... Would it be possible to implement a domain wide policy but to set the accounts / usernames in which I dont want there password to expire in 30 days as 'Password never expires'.

That way, whatever the password is now, it will never ask me to change it for it to even meet the 15 character complexity rule?
0
 
LVL 85

Expert Comment

by:oBdA
ID: 16911999
Yes, that would work.
0
 
LVL 16

Expert Comment

by:Kevin Hays
ID: 16913292
I like that comment Jay_Jay70 :D
Looks like dqnet is thinking outside the box ;)

Cheers

kshays
0
 

Author Comment

by:dqnet
ID: 16914419
Hahaha :)

Ok so one thing, when I go to change the passwords for the servers logins myself, the domain wide rule will apply then yea?
Like I will have to follow the same rules and regulations as I set for the domain (including all the other OU's)

Correct?

Thanks folks...!
0
 
LVL 85

Expert Comment

by:oBdA
ID: 16914431
Exactly. Unless you disable the password policy while changing the passwords ...
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16916517
hey mate how are ya :) sorry for late response, i was in Bed :-P!

looks like you have been looked after though :) can i ask why you want to exclude users from a strong password policy?
0
 
LVL 16

Expert Comment

by:Kevin Hays
ID: 16916994
I agree with Jay here, the more complex and longer the password is the better.  Of course trying to get this implemented to the staff and management is a pain though.  They just don't quite get why my domain admin password is complex with a couple of phrases and between 25-40 characters long.  They believe password should = username1 or username2

DOH!!!!

I tell you there is not a day goes by that I don't get a good laugh :)

kshays

PS:  Not saying you were trying to influence the auther into weak paswords oBdA :)

0
 

Author Comment

by:dqnet
ID: 16918750
Ahh! Excellent! Simply excellent.. I'll disable it when I come to change the server passwords.

Hahahahah! :)

Well the good news is I got them to follow the policy regardless. They have no choice now! >:)
However, Its the Server Logins that I cant keep changing, I have like 5-10 logins and to set a 15 character password for each of them that meets complexity requirements is putting a bit of strain on what needs to be remembered. I set all of them to STRONG passwords, nobody knows them and I just thought keeping them at that would be sufficient?
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16920308
i see what you mean and can understand it, that is your perogative if you want to keep it like that :)
0
 

Author Comment

by:dqnet
ID: 16920782
Well guys!

Thank you all for your help.

I didnt know exactly who to assign the points to as you've all been helpfull.
I simply bumped the points to 200 and divded it between you guys.

Thanks again folks!!
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16921891
thankyou
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

by Batuhan Cetin Within the dynamic life of an IT administrator, we hold many information in our minds like user names, passwords, IDs, phone numbers, incomes, service tags, bills and the order from our wives to buy milk when coming back to home.…
I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question