• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 442
  • Last Modified:

Can you apply a password policy for Wk3 AD to most users but choose exclusions?

Hello. We are trying to tighten the security for our domain. We are running 2k3 native AD. It is my understanding that you can only have one password policy per AD domain. I'm ok with the password policy stength applying to all users, but I'd like to exclude our admin-level accounts from having to change every 90 days. Is there a way to apply the policy to end users ONLY, and exclude admin-level accounts? We had been using our "default domain policy" to define the password policy, and it is targeted to the "authenticated users" security group.

I tried removing the password specifics from the default domain policy, and creating a new GPO that would have the password settings defined, and then tried to link it to a group of users I created for this called "Password_GPO". But running GPRESULT from a workstation shows that the default domain policy is applied whereas the other GPO is ignored. I assume this is because the default policy targets "authenticated users", which means if you log on, it is applicable.

Any help would be appreciated. Thanks!
0
iteaoa
Asked:
iteaoa
1 Solution
 
Donald StewartNetwork AdministratorCommented:
0
 
snusgubbenCommented:
Tick the "Password never expire" on the admin accounts. This will override the password policy.
0
 
iteaoaAuthor Commented:
Interesting. I did not think that would work. If that is the solution, our problem is solved. Not that I don't trust this, but could someone else confirm that this will work?
0
Never miss a deadline with monday.com

The revolutionary project management tool is here!   Plan visually with a single glance and make sure your projects get done.

 
naldiianCommented:
Yes, that works fine - the policy is applied to all accounts that actually have expiration enabled, but with expiration disabled on that account it will not check the policy settings in regards to expiration. Other policy will still apply, such as complexity and lockout rules - though complexity and other rules can be ignored by using the administrative reset process, and then all you get is the lockout rules that will always apply.
0
 
Donald StewartNetwork AdministratorCommented:
Yes "Password never expire"  will also be a workaround>>> especially for example special services configured with a "Service" user that you dont want to always change passwords on.
0
 
iteaoaAuthor Commented:
Thank you! This is much simpler than what I had been planning.
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now