asked on

reactivate changing password policy

hello,
i've an issue in my environment as i consider it is a bug that my ex-manager decided to cancel the policy of changing the password for users every 42 days. and now we need to reactivate it again but i'm asking about the effect when i do that because we've 650 users. i'm asking if i activate this policy does it let all users change their password immediatly or it'll count 42 day and let users change it? my domain is win2012r2 and 2016

thanks

Polydore Dracopoulos

it depends on what you want to change your password policy to?

if it is now 42 and want to go to 30, anyone that is less that 12 days will have expired and needs to change it.
if you are going to 60... it will not affect anyone because they have another 18 days minimum to change it.
if you mean that the current password policy is "do not require password change" and noone changed for 6 months.... then they will all have expired.

so the policy change does not RESET the expiration of the password, it just "calculates the difference."

Asfour Crystal

ASKER

many thnaks sirdragon for your replay, yes in my situation it's completly disable and equel the password never expired. so if i apply the policy for the default 42 days it'll ask all users to reset their passwor immediatly, am i right?
Thanks

Polydore Dracopoulos

yes... if this was done prior to 42 days, all password will immediately expire.

Asfour Crystal

ASKER

ok, is there a way to make this per groups because if i apply it on the whole environment it'll give bad feedback as i think, i just need away to reactivate this policy step by step

Polydore Dracopoulos

no unfortunately Password GPO is for the whole domain.

what you should do is have a mass mail sent to all users.. explain the situation and give them a specific date that they will need to do this.
if you have remote users, they may need a temp password if they use VPN or other solution to come in.

Asfour Crystal

ASKER

many thanks sirdragon for your explnation.