• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 613
  • Last Modified:

Setup Fine-Grained Password Policy

Windows 2008 R2 ADDS

Inherited setup were previous sysadmin, disabled all pwd security on the domain... also removed from 'Default Domain Policy' .....I am restoring this back to defaults...however a group of users (say Global security group ALL-XYZ) requires a different password policy than the default, these users are spread across several OUs ann sub-OUs

...so i setup a FGPP with ADSI and assigned the group.....but some where I read about Shadow Groups....what are they, how do they apply to FGPP, are they the same as a regular group?

here is what I did to setup the FGPP with ADSI..
http://akrameleyan.wordpress.com/2013/01/06/why-and-how-to-use-fine-grained-password-policies/

Am I missing something...Do I have to link the user OSs? How since this is not done in GPO Manager?? I don't have a test enviornment so want to be sure before I execute
0
BigBadWolf_000
Asked:
BigBadWolf_000
  • 4
  • 3
2 Solutions
 
Mike KlineCommented:
Shadow groups are not real groups.  They are groups that people create using scripts for example automatically put every person in OU X into Group X.  

By the way if you have one Windows 8 or Windows 2012 box (member server is fine) setup you can use AD Admin Center to work with FGPP...much easier than adsiedit.

Thanks

Mike
0
 
BigBadWolf_000Author Commented:
mkline71:  "A shadow group is a global security group that is logically mapped to an OU to enforce a fine-grained password policy. "

Still not clear...how do I map a shadow group to an OU? Does'nt a group created via PS/script still show as a group in the Windows interface?

zenvenky: Very good links thanks!

both: so to summarize, unless I need to bind a PSO to an OU, I don't need to worry about shadow groups correct?
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
Mike KlineCommented:
It does so you would create/script your group and have that PSO (passwords setting object) apply to that group.

The group in this example would contain every user in that OU...not actually mapped to the OU.  PSOs can only be applied to users/groups not OUs.

Thanks
Mike
0
 
BigBadWolf_000Author Commented:
mike: I have a (nested) Group, say 'All_Contractors'
I have a GPO setup with the password policy - Linked location is the root OU, Security Filtering is the 'All_Contractors' group

In the PSO via adsiedit... msDS-PSOAppliesTo...points to 'All_Contractors'
and I verified that the appropriate user has attrib msDS-ResultantPSO pointing to 'All_Contractors'

Should I do something else to connect the PSO to the Group via GPO? or am I done...wont be able to tell till I change the policy settings :)
0
 
BigBadWolf_000Author Commented:
Hi mkline71 : could you please provide feedback on my quesyion above...thanks :)
0
 
Mike KlineCommented:
You should be done, by the way if you get one Windows 8 or 2012 box (member server is fine) you can use the new AD Admin Center which makes working with FGPP much easier.

Thanks

Mike
0
 
BigBadWolf_000Author Commented:
Thanks!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

The 14th Annual Expert Award Winners

The results are in! Meet the top members of our 2017 Expert Awards. Congratulations to all who qualified!

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now