Two Password Policies

Posted on 2010-09-20
Last Modified: 2012-05-10
I have a password policy at my Domain level that is being forced down to the lower OUs.  However, I have two OUs where I need to stop this policy from applying.  I can't block inheritance, because I have other polcies that still need to apply.

Any ideas on the best way to go about this?
Question by:januismer
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4

Accepted Solution

Ronin_1 earned 250 total points
ID: 33715772
Take a look at the following this explains how to use fine grained password policies.

LVL 59

Expert Comment

by:Darius Ghassem
ID: 33716113
You can not block password policy you can implement what Ronin suggested which is fine grained password polices.

Good article.

Author Comment

ID: 33718402
Thanks for the responses!

In reading Ronin's suggestion I ran across this on YouTube which sheds some real world light on the subject:

Essentially its all the same thing that Ronin and darisq are talking about.  I went through the steps and have the PSO created and applied to my group, BUT...

Here is my dilemma, we're creating these accounts for elementary students (grades K-5).  We don't give them passwords and basically have the passwords set to (blank).  We have to turn off the Domain policy initially to get this to fly when we create the accounts in mass.  Now that school is in session and the majority of accounts have been created, we only need to deal with new students.  When copying/creating a new student from an existing student the adding of the new student fails with this error even though the PSO is in place:

"Windows cannot create the object because:  Unable to update the password. The value provided for the new password does not meeting the length, complexity, or history requirements for the domain."

Any ideas?  I don't want to have to turn the domain policy off/on every time I need to add a new student.

Here are my settings for the PSO:

Password Settings Precedence = 1
Encryption Enabled = FALSE
History Length = 24
Complexity Enabled = FALSE
Password Length = 0
Minimum Password Age = 1:00:00:00
Maximum Password Age = 365:00:00:00
Lockout Threshold = 0
Lockout Observation = (none)
Lockout Duration = (non)
Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

LVL 59

Expert Comment

by:Darius Ghassem
ID: 33718878
Now when you are copying the users the min is not being meet. Try creating a new user.

Author Comment

ID: 33719051
Just tried it and received the same error.
LVL 59

Assisted Solution

by:Darius Ghassem
Darius Ghassem earned 250 total points
ID: 33719073
You are going to have to meet the password requirements with new users. I'm thinking exisiting so there is not a way around you must meet the requirements at creation

Author Comment

ID: 33719088
But then I could have them reset them to blank do you think?
LVL 59

Expert Comment

by:Darius Ghassem
ID: 33719119
If you remove the password policy you can then add blank passwords but I suggest you give the user a default password the meets the requirements

Author Comment

ID: 33734895
Thanks... Meeting the policy initially, but then changing it thereafter works!

Thanks again!

Author Closing Comment

ID: 33780156
Thanks for you help!

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Can’t disable NAT protocol in Windows Server 2012 3 129
NTP time source for DC 3 90
IIS Authentication Error 401 16 70
Windows 10 Policy for Flash 3 56
You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question