<div>
I would change that 2 days to 180 days.<br />
<br />
The default is 42 days as seen here.<br />
<br />
<a href="https://technet.microsoft.com/en-us/library/hh994573(v=ws.11).aspx" rel="ugc">https://technet.microsoft.com/en-us/library/hh994573(v=ws.11).aspx</a><br />
<br />
If I had to guess, I'd say the &quot;4&quot; was accidently deleted.<br />
<br />
Take a look at this YouTube video to make sure you didn't miss a step.
</div>


<div>
Also, do a gpresult /h to see if the policy is being applied to the workstations.<br />
<br />
<a href="https://technet.microsoft.com/en-us/library/cc733160(v=ws.11).aspx" rel="ugc">https://technet.microsoft.com/en-us/library/cc733160(v=ws.11).aspx</a>
</div>


<div>
Ok, I changed it to 180 days. But that doesn't change the fact that it's still not working. I changed to to 2 days on purpose.
</div>


<div>
Where is the GPO linked? Password policies on a domain will only work when they are linked to the Domain itself. Password policies linked to OUs will only modify the password requirements for local accounts of computers in the OU and its children.<br />
<br />
Also, make sure that the policy you are setting the password requirements in has the highest precedence for all GPOs that define password policy.
</div>


<div>
Ok, I did the gpresult /h<br />
<br />
Here is the result:<br />
<br />
<a href="https://filedb.experts-exchange.com/incoming/2017/03_w10/1149297/gpresult.png" target="_blank" title="Group Policy Result (47 KB)"><img alt="Group Policy Result" class="file-block lazyload" style="max-width: 800px;" data-src="https://filedb.experts-exchange.com/incoming/2017/03_w10/800_1149297/gpresult.png" /></a>
</div>


gpresult.png

<div>
Where do I find out where the GPO is linked?
</div>


<div>
I think it's linked to the domain. I could be wrong though.<br />
<br />
I did notice that the Enforced setting was set to &quot;No&quot;. Could that have been the problem? I just changed it to &quot;Yes&quot;.<br />
<br />
<a href="https://filedb.experts-exchange.com/incoming/2017/03_w10/1149341/group-policy-management.png" target="_blank" title="Group Policy Management (50 KB)"><img alt="Group Policy Management" class="file-block lazyload" style="max-width: 800px;" data-src="https://filedb.experts-exchange.com/incoming/2017/03_w10/800_1149341/group-policy-management.png" /></a><a href="https://filedb.experts-exchange.com/incoming/2017/03_w10/1149340/group-policy-management.png" target="_blank" class="file-inline" title="group-policy-management.png (50 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>group-policy-management.png</a>
</div>


group-policy-management.png

<div>
Okay, I added Domain users to the security filtering.<br />
<br />
Here are my RSOP results:<br />
<br />
<a href="https://filedb.experts-exchange.com/incoming/2017/03_w10/1149351/RSOP-results.png" target="_blank" title="RSOP results (53 KB)"><img alt="RSOP results" class="file-block lazyload" style="max-width: 800px;" data-src="https://filedb.experts-exchange.com/incoming/2017/03_w10/800_1149351/RSOP-results.png" /></a>
</div>


RSOP-results.png

<div>
Yes, you do have it applied at the domain level and the policy is being applied as shown in the grpresult /h command.<br />
<br />
From the looks of it, it should be working as expected.
</div>


<div>
Okay, so I tried logging off and logging back on. It doesn't appear to be working. Shouldn't it be asking for me to change my password by now?
</div>


<div>
So_Cal,<br />
<br />
What does RSOP return as the effective policy for Computer Configuration &gt;&nbsp;Policies &gt;&nbsp;Windows Settings &gt;&nbsp;Security Settings &gt;&nbsp;Security Options &gt;&nbsp;Interactive Logon: Prompt user to change password before expiration ?
</div>


<div>
Sean - It says &quot;Not Defined&quot;
</div>


<div>
From my understanding he'll have to wait 2 days to get the prompt correct?
</div>


<div>
I created a test account, it said I must change the password before logging in for the first time.
</div>


<div>
@Scott C- No, because if their password max length is 2 days, and his notification is 2 days prior to expiration, it should immediatelly notify them.<br />
<br />
@so_cal- Uncheck &quot;User must change password&quot; when creating the account.
</div>


<div>
@Sean - I created another test account (unchecked the box), logged in, and it didn't prompt me to change the password (using all the settings you mentioned above). I don't understand why it isn't working.
</div>


<div>
Sean, or anyone, can you please help me as to why it isn't working?
</div>


<div>
Run this on PDC and post<br />

<pre><code class="code-1 nolinks" id="code-20-42053795-1"><span>NET ACCOUNTS</span>
</code></pre>
</div>


<div>
Shaun:<br />
<a href="https://filedb.experts-exchange.com/incoming/2017/03_w12/1151730/command-prompt.png" target="_blank" title="net accounts (12 KB)"><img alt="net accounts" class="file-block lazyload" style="max-width: 670px;" data-src="https://filedb.experts-exchange.com/incoming/2017/03_w12/1151730/command-prompt.png" /></a>
</div>


command-prompt.png

<div>
Been playing around with the settings. Here is my latest net accounts result:<br />
<a href="https://filedb.experts-exchange.com/incoming/2017/03_w12/1151768/command-prompt2.png" target="_blank" title="net accounts (10 KB)"><img alt="net accounts" class="file-block lazyload" style="max-width: 664px;" data-src="https://filedb.experts-exchange.com/incoming/2017/03_w12/1151768/command-prompt2.png" /></a>
</div>


command-prompt2.png

<div>
Just as an FYI, running Net accounts on anything other than a DC will only show the password settings for that computer's local accounts.
</div>


<div>
I think it's actually working now. Oh my goodness.
</div>


<div>
Well, it asked some of the users to change passwords, but not all, including mine. Why would it do this?
</div>


<div>
Password expiration date is a per account property. It's not affected by modify GPO. You need to set the accounts to expire the password. GPO affects changes going forward.
</div>


<div>
Oh, okay. So I need to go into each individual account in Active Directory Users and Computers?
</div>


<div>
<div class="content wysiwyg-content">
I'm trying to get my GPO to work to have all my users on my network change their passwords every 6 months effective immediately, but it isn't working. I realize in the picture it says 2 days.<br />
<br />
I've tried gpupdate and gpupdate/force. Also have tried logging off a workstation and logging back on. Still not working. I'm not sure what I'm doing wrong. Please advise. The workstations are mostly Windows 7 Pro and it's Server 2012 R2.<br />
<br />
<a href="https://filedb.experts-exchange.com/incoming/2017/03_w10/1149274/group-policy.png" target="_blank" title="Group Policy Management Editor (28 KB)"><img alt="Group Policy Management Editor" class="file-block lazyload" style="max-width: 800px;" data-src="https://filedb.experts-exchange.com/incoming/2017/03_w10/800_1149274/group-policy.png" /></a><a href="https://filedb.experts-exchange.com/incoming/2017/03_w10/1149272/group-policy.png" target="_blank" class="file-inline" title="Group Policy Management Editor (28 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>group-policy.png</a>
</div>
</div>


group-policy.png

I'm trying to get my GPO to work to have all my users on my network change their passwords every 6 months effective immediately, but it isn't working. I realize in the picture it says 2 days.

I've tried gpupdate and gpupdate/force. Also have tried logging off a workstation and logging back on. Still not working. I'm not sure what I'm doing wrong. Please advise. The workstations are mostly Windows 7 Pro and it's Server 2012 R2.



How do I get my Password GPO settings to work on my Network?

Windows 7 is an operating system from Microsoft. Features include multi-touch support, a redesigned Windows Shell with a new taskbar, referred to as the Superbar, a home networking system called HomeGroup, and performance improvements.

Windows 7

Windows Server 2012 is the server version of Windows 8 and the successor to Windows Server 2008 R2. Windows Server 2012 is the first version of Windows Server to have no support for Itanium-based computers since Windows NT 4.0. Windows Server 2012, now in its second release (Windows Server 2012 Release 2) includes Foundation, Essentials, Standard and Datacenter, and does not support IA-32 or IA-64 processors.

Windows Server 2012

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.