Avatar of csg-unit
csg-unitFlag for United States of America

asked on 

How do I force a non-compliant AD password for a new user?

We have an organizational requirement in Active Directory to have a 10 character password that uses Complexity Requirements.  However, we must set new users' initial password as 10 chars WITHOUT complexity (one upper case letter, 9 numbers, for example H123456789).  obviously we hit an error when we attempt to do it this way, saying its not complex enough.  I've been asked to force it anyway, as it would solve some massive unsolvable issues. is there a way to do it?  Thanks this community rocks
Active Directory

Avatar of undefined
Last Comment
csg-unit
Avatar of Paul MacDonald
Paul MacDonald
Flag of United States of America image

Open up Active Directory Users and Computers, find the User object in question, right-click on it and select "Reset Password".  Enter the new password (or have the user enter the password) and save it.
Avatar of Bembi
Bembi
Flag of Germany image

The other option would be, to create a special OU for new Users with a GPO, which is less restrictive.
After that, you can move the computer.
But I guess Pauls answer is a little bit less work. 
Avatar of csg-unit
csg-unit
Flag of United States of America image

ASKER

I attempted to reset to the desired password and got the following:  
and the GPO would actually need to be Fine Grained Password Policy but it would probably work

User generated image
That's interesting - I've never run into that before.  Were you changing the password as a domain admin?  
We have an organizational requirement in Active Directory to have a 10 character password that uses Complexity Requirements.  However, we must set new users' initial password as 10 chars WITHOUT complexity (one upper case letter, 9 numbers, for example H123456789).  


Who ever suggested this is WRONG as it fails organization requirements.


You need to setup a fine-grained password policy that the user is a member of. password complexity is either ON or OFF
Avatar of Bembi
Bembi
Flag of Germany image

So, comming back to an OU, which is less restrictive, and after the pasword is set, you can move the user to the regulat OU. 
Avatar of csg-unit
csg-unit
Flag of United States of America image

ASKER

I was changing it as a member of the domain administrators group.  Yes they are wrong, my whole company agrees. I agree, FGPP has to be enabled on an OU.

My one outstanding question is Paul MacDonald's insinuating the ability to reset it against requirements in certain situations.  We're at 2012R2 forest level.
Avatar of Andrew Porter
Andrew Porter
Flag of United States of America image

Preface: This is a terrible idea, as David indicates above.

If you still want to do it, just login to a Domain Controller and set it directly from there. This will bypass the complexity requirements that are in your way.
ASKER CERTIFIED SOLUTION
Avatar of kevinhsieh
kevinhsieh
Flag of United States of America image

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
Avatar of serialband
serialband
Flag of Ukraine image

It used to work, but they've closed that security loophole with recent updates.

Avatar of kevinhsieh
kevinhsieh
Flag of United States of America image

You can also say that technical limitations don't allow the initial password to not meet the requirements.  :-)
Avatar of Jeff Glover
Jeff Glover
Flag of United States of America image

Basically, you can't get there from here. It makes no difference whether or not you set/reset the password as a Domain admin, Enterprise admin, from a DC, from anywhere. (Since using ADUC ALWAYS connects you to a Full DC, even if you are running the tools from a Windows 10 Workstation.) The complexity settings for Passwords will always apply unless you, as said, use Fine Grained Password policies and these only apply to groups, not OUs. I am not sure why you cannot just do Hh12345678 instead of H123456789. This would solve your issue. If the process cannot handle that, I would say develop a better process.
Avatar of Bembi
Bembi
Flag of Germany image

is this issue solved?
I yes, you may close the question.
Avatar of csg-unit
csg-unit
Flag of United States of America image

ASKER

I will close this question.  The process, though incorrect, is required because of some SQL Operations done against the password before the user starts and changes upon first logon, and there is inflexibility with that SQL script.  Unfortunately.....
Our process is we are disabling the password policy entirely during new user creation. We have to enforce FGPP which is not fun to administer as an MSP.  Thanks all!
Active Directory
Active Directory

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.

86K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
Ask the experts
Read over 600 more reviews

TRUSTED BY

IBM logoIntel logoMicrosoft logoUbisoft logoSAP logo
Qualcomm logoCitrix Systems logoWorkday logoErnst & Young logo
High performer badgeUsers love us badge
LinkedIn logoFacebook logoX logoInstagram logoTikTok logoYouTube logo