Password history and length: Group Policy

I have set the following policy...
Computer configuration > Windows Settings > Security Settings > Account Policies/Password Policy
Enforce password history = 8
Maximum password age = 45
Minimum password age = 30
Minimum password length = 8

However, I have just tried to change a password on a user account to what was the old password, it allowed me to do so. I also tried changing the user's password to less than 8 characters, this also succeeded.

I've ran rsop under the users account and the group policy settings appear to be in place.

We are running a 2003 forest. The client machine I attempted this on was a Windows 7 machine, the user account has domain administrator access (it's actually my own personal account)

Why have these restrictions not taken affect?
cbsbutlerAsked:
Who is Participating?
 
SGrossmannConnect With a Mentor Commented:
did you set this policy to the domain?If not those settings are ignored.By default password settings are set within the default domain policy
0
 
oBdAConnect With a Mentor Commented:
Probably because the policy you're testing this with is not linked to the domain root, or there's another GPO linked to the domain root with a higher priority in which password policy settings are defined, or because inheritance to the OU DOmain Controllers is disabled.
In a W2k3 AD domain, you can only have *one* password policy, it *has* to be linked to the *domain* *root*, and it *has* to be applied to the DCs.
Fine-grained password policies are only possible in a W2k8 AD, or with 3rd-party tools like from http://www.anixis.com/ or http://www.specopssoft.com/
Password policies applied to an OU will only influence *local* accounts on the computers in this OU.
0
 
Krzysztof PytkoSenior Active Directory EngineerCommented:
enable additionally password complexity in the same node. Then check if you modified those settings in Default Domain Policy. Windows 2003 doesn't allow having more that 1 password policy for domain. Each additional policy will be rejected. The only one taking effect is set at domain level (Default Domain Policy)
0
 
Krzysztof PytkoSenior Active Directory EngineerCommented:
Of course my second part of answer is described by oBdA (sorry I didn't see it before) and he's right.

@cbsbutler: Ignore my post please
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.