Can you apply a password policy for Wk3 AD to most users but choose exclusions?

Hello. We are trying to tighten the security for our domain. We are running 2k3 native AD. It is my understanding that you can only have one password policy per AD domain. I'm ok with the password policy stength applying to all users, but I'd like to exclude our admin-level accounts from having to change every 90 days. Is there a way to apply the policy to end users ONLY, and exclude admin-level accounts? We had been using our "default domain policy" to define the password policy, and it is targeted to the "authenticated users" security group.

I tried removing the password specifics from the default domain policy, and creating a new GPO that would have the password settings defined, and then tried to link it to a group of users I created for this called "Password_GPO". But running GPRESULT from a workstation shows that the default domain policy is applied whereas the other GPO is ignored. I assume this is because the default policy targets "authenticated users", which means if you log on, it is applicable.

Any help would be appreciated. Thanks!
iteaoaAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

DonNetwork AdministratorCommented:
0
snusgubbenCommented:
Tick the "Password never expire" on the admin accounts. This will override the password policy.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
iteaoaAuthor Commented:
Interesting. I did not think that would work. If that is the solution, our problem is solved. Not that I don't trust this, but could someone else confirm that this will work?
0
ON-DEMAND: 10 Easy Ways to Lose a Password

Learn about the methods that hackers use to lift real, working credentials from even the most security-savvy employees in this on-demand webinar. We cover the importance of multi-factor authentication and how these solutions can better protect your business!

Listen On-demand
naldiianCommented:
Yes, that works fine - the policy is applied to all accounts that actually have expiration enabled, but with expiration disabled on that account it will not check the policy settings in regards to expiration. Other policy will still apply, such as complexity and lockout rules - though complexity and other rules can be ignored by using the administrative reset process, and then all you get is the lockout rules that will always apply.
0
DonNetwork AdministratorCommented:
Yes "Password never expire"  will also be a workaround>>> especially for example special services configured with a "Service" user that you dont want to always change passwords on.
0
iteaoaAuthor Commented:
Thank you! This is much simpler than what I had been planning.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.