Default Domain Policy password settings not working correctly
In my server 2008 r2 domain I have a password policy set at the domain level saying that passwords expire every 180 days. 41 days ago I forced a reset of all users passwords and now everyone is getting a message saying that their password expires tomorrow. When I check the gpo it still says 180 days. When I look at the properties of the domain under AD Users and Computers it says password expires every 42 days but I thought that only applied to the default domain administrator account. I did try changing that but it resets itself back to 42 days when I refresh. Any help would be greatly appreciated!!
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
another note, when I run "net accounts" it tells me that maximum password age is 42.....
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I think I am. I have the default domain policy, in it I have specified that passwords expire after 180 days and specifies a max password length and complexity. This was added to the DDP a week before forcing the users to reset their passwords. I do not have any other gpos linked at the domain level and I am not using Fine Grained Password Policies. When I set this up I was under the impression that when a user resets their password it will then check the password settings on a gpo only at the domain level and this then applies to their account. When I do a reset of a user now then check their account using net user /domain username before the reset it would say it expired tomorrow, 42 days from the reset. After the reset it will say it was reset today but then lists the expiration as 180 days from today. So the settings are working now, but nothing has changed in group policy since the week before the reset, so that is where my greatest confusion comes from.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
The policy is applied to the entire OU structure, we do not have any blocking inheritance. I have run RSOP reports on both the DCs and the workstations and they all say that the DDP is being applied.
As near as I can tell there is nothing wrong with the GPO or with it being applied. Is their anywhere else at all that could be causing the accounts to see 42 days?
I also checked to make sure that we do not have fine grained password policies in use. We do not.
I also tried running Get-ADDefaultDomainPasswor
As near as I can tell there is nothing wrong with the GPO or with it being applied. Is their anywhere else at all that could be causing the accounts to see 42 days?
I also checked to make sure that we do not have fine grained password policies in use. We do not.
I also tried running Get-ADDefaultDomainPasswor
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I think I have an idea on what was causing this. We have 5 DCs, two are RODCs. The one that hosts the PDC emulator was the one that all of the GP changes were being made to. When I changed to check the GPO by specifying a different DC the Default Domain Policy had different settings. So apparently our GPOs are not replicating between all of our DCs, and that is probably what caused the issue. I do know that replication works for AD, DNS and DHCP so not sure why just those are not working but I am going to run a few tests and check replication logs to see.
Does this sound like anything you have run into before?
Does this sound like anything you have run into before?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I did a check for those event errors and I found a few, all from over 6 months ago, nothing more recent than that.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you all for your help!
ASKER