asked on

How to configure specific password policy for a single OU

Hello -

We are running in a mixed mode active directory environment (2003 and 2008 R2 servers). We have about 20 service account located within 1 OU that we'd like to have a different minimum password age than the rest of the default group policy. Is there a way to do this? I'm getting a ton of conflicting info on this topic. My thought was to block policy inheritance, somehow get our default settings reapplied to this OU, and then change the one setting i need.

Is there a way?

thanks

-Josh

ASKER CERTIFIED SOLUTION

Mike Kline

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Brian Pierce

You can't - you can only have one password policy per domain. - however you can use a fine-grained password policy (assuming you have server 2008), to apply a different policy to a security group

http://akrameleyan.wordpress.com/2013/01/06/why-and-how-to-use-fine-grained-password-policies/

Venkat Suresh

Agree with other experts. You have only one option and that is FGGPP (Fine-Grained Password Policy). For more info about FGPP refer below links.

http://blogs.technet.com/b/canitpro/archive/2013/05/30/step-by-step-enabling-and-using-fine-grained-password-policies-in-ad.aspx

http://technet.microsoft.com/en-us/library/cc770394(v=ws.10).aspx

http://blogs.chrisse.se/quick-start-guide-for-fine-grain-password-policy-tool/

David Tolo Technology Manager

ASKER

thanks guys, that is what i thought but was hoping you had a magic answer i had missed. i'll have to wait until i get to a true 2008 environment.

Mike Kline

There are also third party tools like specops that can help in your 2003 domain I'd save the cash until you get to 2008

Thanks

Mike