?
Solved

Two Password Policies

Posted on 2010-09-20
10
Medium Priority
?
534 Views
Last Modified: 2012-05-10
I have a password policy at my Domain level that is being forced down to the lower OUs.  However, I have two OUs where I need to stop this policy from applying.  I can't block inheritance, because I have other polcies that still need to apply.

Any ideas on the best way to go about this?
0
Comment
Question by:januismer
  • 5
  • 4
10 Comments
 
LVL 7

Accepted Solution

by:
Ronin_1 earned 1000 total points
ID: 33715772
Take a look at the following this explains how to use fine grained password policies.

http://technet.microsoft.com/en-us/library/cc770394%28WS.10%29.aspx

0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 33716113
You can not block password policy you can implement what Ronin suggested which is fine grained password polices.

Good article.

http://blogs.technet.com/b/seanearp/archive/2007/10/06/windows-server-2008-fine-grained-password-policy-walkthrough.aspx
0
 
LVL 1

Author Comment

by:januismer
ID: 33718402
Thanks for the responses!

In reading Ronin's suggestion I ran across this on YouTube which sheds some real world light on the subject:

http://www.youtube.com/watch?v=kmShKNZ83e4

Essentially its all the same thing that Ronin and darisq are talking about.  I went through the steps and have the PSO created and applied to my group, BUT...

Here is my dilemma, we're creating these accounts for elementary students (grades K-5).  We don't give them passwords and basically have the passwords set to (blank).  We have to turn off the Domain policy initially to get this to fly when we create the accounts in mass.  Now that school is in session and the majority of accounts have been created, we only need to deal with new students.  When copying/creating a new student from an existing student the adding of the new student fails with this error even though the PSO is in place:

"Windows cannot create the object because:  Unable to update the password. The value provided for the new password does not meeting the length, complexity, or history requirements for the domain."

Any ideas?  I don't want to have to turn the domain policy off/on every time I need to add a new student.

Here are my settings for the PSO:

Password Settings Precedence = 1
Encryption Enabled = FALSE
History Length = 24
Complexity Enabled = FALSE
Password Length = 0
Minimum Password Age = 1:00:00:00
Maximum Password Age = 365:00:00:00
Lockout Threshold = 0
Lockout Observation = (none)
Lockout Duration = (non)
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 33718878
Now when you are copying the users the min is not being meet. Try creating a new user.
0
 
LVL 1

Author Comment

by:januismer
ID: 33719051
Just tried it and received the same error.
0
 
LVL 59

Assisted Solution

by:Darius Ghassem
Darius Ghassem earned 1000 total points
ID: 33719073
You are going to have to meet the password requirements with new users. I'm thinking exisiting so there is not a way around you must meet the requirements at creation
0
 
LVL 1

Author Comment

by:januismer
ID: 33719088
But then I could have them reset them to blank do you think?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 33719119
If you remove the password policy you can then add blank passwords but I suggest you give the user a default password the meets the requirements
0
 
LVL 1

Author Comment

by:januismer
ID: 33734895
Thanks... Meeting the policy initially, but then changing it thereafter works!

Thanks again!
0
 
LVL 1

Author Closing Comment

by:januismer
ID: 33780156
Thanks for you help!
0

Featured Post

Upgrade your Question Security!

Add Premium security features to your question to ensure its privacy or anonymity. Learn more about your ability to control Question Security today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
Suggested Courses

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question