We help IT Professionals succeed at work.

Fine Grained Password Policy PSO

csg-unit
csg-unit asked
on
8 Comments
1 Solution
152 Views
Last Modified: 2018-05-24
Long listShort list
Hi. I ran this same command at two different customers to create a fine grained Password policy.  in ADSIEDIT, We see differing quantities of available attributes.  One of those attributes that exists at Customer A, is missing at Customer B's site is the "AppliesTo" attribute, which is needed.    does anyone know why they differ?

Both running 2012 R2 Domain controllers.  I tried to generate forestlevel but says "Referral was returned from the server"

New-ADFineGrainedPasswordPolicy -Name "FineGrainedPSO" -Precedence 500 -ComplexityEnabled $true -Description "Fine-Grained Password Policy"-DisplayName "Fine-Grained Password Policy" -LockoutDuration "0.12:00:00" -LockoutObservationWindow "0.00:15:00" -LockoutThreshold 7 -MaxPasswordAge "155.00:00:00" -MinPasswordAge "2.00:00:00" -MinPasswordLength 8 -PasswordHistoryCount 5 -ReversibleEncryptionEnabled $false

Open in new window

Comment
Watch Question

View Solution Only

Cliff Galiher
CERTIFIED EXPERT
Distinguished Expert 2018

Commented:
Differences can be attributed to the schema level of the domain and forest.  Adprep changes these, and I have seen environments where a higher level DC was introduced then pulled back for whatever reason.  But schema changes are permanent, so the schema level can be higher than the highest level DC still in the environment.

Another thing to look at is the functional levels of the domain.  You can have 2012 R2 DCs and still have the functional levels at 2003, for example. The functional level must be lower than the *oldest* DC OS in the environment.  Many people retire old DCs but then don't raise the functional level.
Kevin StanushApplication Developer

Commented:
Try looking at the password policy object using the Administrative Center or a 3rd party app like Hyena.  ADSIEdit is not a friendly way to deal with PSOs.
csg-unit

Author

Commented:
OK, I had a feeling that was important.  note the short list is 2012 and long list is 2008 R2 level.  is there something else I should look for?  2008 R2 level seems to have more abilities.  Customer A forest - Long List of AttributesCustomer B forest - Short List of Attributes
Cliff Galiher
CERTIFIED EXPERT
Distinguished Expert 2018

Commented:
Newer adds more abilities. I can't think of any that we're taken away from 2008 R2, to 2012 R2. So not sure why you think 2008R2 has more features.
Application Developer
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION
csg-unit

Author

Commented:
I understand abilities are added with each revision.  Attributes in the Fine-Grained-Password Policy must have been reduced for another reason.
Kevin StanushApplication Developer

Commented:
Look to see if you have the msDS-xxx attributes, as these are where the PSO settings are stored.  Like I said, nothing has changed.  If you are not going to use a GUI to manage the PSO, look at the objectclass attribute.  In your original screenshot, you have shown all of the attributes defined for the object's parent, so most are <not set>, you need to scroll down to see the ones that are 'missing'.
csg-unit

Author

Commented:
Indeed you are correct. Logging in as the built-in administrator vs member of administrators group changed the quantity of visible attributes on Customer B's site to the appearance of Customer A.  Thank you

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions