Solved

Two Password Policies

Posted on 2010-09-20
10
514 Views
Last Modified: 2012-05-10
I have a password policy at my Domain level that is being forced down to the lower OUs.  However, I have two OUs where I need to stop this policy from applying.  I can't block inheritance, because I have other polcies that still need to apply.

Any ideas on the best way to go about this?
0
Comment
Question by:januismer
  • 5
  • 4
10 Comments
 
LVL 7

Accepted Solution

by:
Ronin_1 earned 250 total points
ID: 33715772
Take a look at the following this explains how to use fine grained password policies.

http://technet.microsoft.com/en-us/library/cc770394%28WS.10%29.aspx

0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 33716113
You can not block password policy you can implement what Ronin suggested which is fine grained password polices.

Good article.

http://blogs.technet.com/b/seanearp/archive/2007/10/06/windows-server-2008-fine-grained-password-policy-walkthrough.aspx
0
 
LVL 1

Author Comment

by:januismer
ID: 33718402
Thanks for the responses!

In reading Ronin's suggestion I ran across this on YouTube which sheds some real world light on the subject:

http://www.youtube.com/watch?v=kmShKNZ83e4

Essentially its all the same thing that Ronin and darisq are talking about.  I went through the steps and have the PSO created and applied to my group, BUT...

Here is my dilemma, we're creating these accounts for elementary students (grades K-5).  We don't give them passwords and basically have the passwords set to (blank).  We have to turn off the Domain policy initially to get this to fly when we create the accounts in mass.  Now that school is in session and the majority of accounts have been created, we only need to deal with new students.  When copying/creating a new student from an existing student the adding of the new student fails with this error even though the PSO is in place:

"Windows cannot create the object because:  Unable to update the password. The value provided for the new password does not meeting the length, complexity, or history requirements for the domain."

Any ideas?  I don't want to have to turn the domain policy off/on every time I need to add a new student.

Here are my settings for the PSO:

Password Settings Precedence = 1
Encryption Enabled = FALSE
History Length = 24
Complexity Enabled = FALSE
Password Length = 0
Minimum Password Age = 1:00:00:00
Maximum Password Age = 365:00:00:00
Lockout Threshold = 0
Lockout Observation = (none)
Lockout Duration = (non)
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 33718878
Now when you are copying the users the min is not being meet. Try creating a new user.
0
 
LVL 1

Author Comment

by:januismer
ID: 33719051
Just tried it and received the same error.
0
 
LVL 59

Assisted Solution

by:Darius Ghassem
Darius Ghassem earned 250 total points
ID: 33719073
You are going to have to meet the password requirements with new users. I'm thinking exisiting so there is not a way around you must meet the requirements at creation
0
 
LVL 1

Author Comment

by:januismer
ID: 33719088
But then I could have them reset them to blank do you think?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 33719119
If you remove the password policy you can then add blank passwords but I suggest you give the user a default password the meets the requirements
0
 
LVL 1

Author Comment

by:januismer
ID: 33734895
Thanks... Meeting the policy initially, but then changing it thereafter works!

Thanks again!
0
 
LVL 1

Author Closing Comment

by:januismer
ID: 33780156
Thanks for you help!
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

We recently had an issue where out of nowhere, end users started indicating that their logins to our terminal server were just showing a "blank screen." After checking the usual suspects -- profiles, shell=explorer.exe in the registry, userinit.exe,…
Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question