Can you apply a password policy for Wk3 AD to most users but choose exclusions?
Hello. We are trying to tighten the security for our domain. We are running 2k3 native AD. It is my understanding that you can only have one password policy per AD domain. I'm ok with the password policy stength applying to all users, but I'd like to exclude our admin-level accounts from having to change every 90 days. Is there a way to apply the policy to end users ONLY, and exclude admin-level accounts? We had been using our "default domain policy" to define the password policy, and it is targeted to the "authenticated users" security group.
I tried removing the password specifics from the default domain policy, and creating a new GPO that would have the password settings defined, and then tried to link it to a group of users I created for this called "Password_GPO". But running GPRESULT from a workstation shows that the default domain policy is applied whereas the other GPO is ignored. I assume this is because the default policy targets "authenticated users", which means if you log on, it is applicable.
Any help would be appreciated. Thanks!
I tried removing the password specifics from the default domain policy, and creating a new GPO that would have the password settings defined, and then tried to link it to a group of users I created for this called "Password_GPO". But running GPRESULT from a workstation shows that the default domain policy is applied whereas the other GPO is ignored. I assume this is because the default policy targets "authenticated users", which means if you log on, it is applicable.
Any help would be appreciated. Thanks!
Don
Understanding Password Policies
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Interesting. I did not think that would work. If that is the solution, our problem is solved. Not that I don't trust this, but could someone else confirm that this will work?
Yes, that works fine - the policy is applied to all accounts that actually have expiration enabled, but with expiration disabled on that account it will not check the policy settings in regards to expiration. Other policy will still apply, such as complexity and lockout rules - though complexity and other rules can be ignored by using the administrative reset process, and then all you get is the lockout rules that will always apply.
Yes "Password never expire" will also be a workaround>>> especially for example special services configured with a "Service" user that you dont want to always change passwords on.
ASKER
Thank you! This is much simpler than what I had been planning.