Windows 2008 Granular Password Policies
Closed     Case # 10033     Affiliated Job:  New Trier Township District 2031
Opened:  Monday, April 26, 2010     Closed:  Friday, April 30, 2010
Total Hit Count:  18775     Last Hit:  Wednesday, October 18, 2017 6:29:39 PM
Unique Hit Count:  3459     Last Unique Hit:  Wednesday, October 18, 2017 6:29:39 PM
Case Type(s):  Server, Network
Case Notes(s):  All cases are posted for review purposes only. Any implementations should be performed at your own risk.

In our environment we wanted to establish multiple password polices; students, technology and staff. A Windows 2008 Native environment allows for just this.

Action(s) Performed:
Total Action(s): 4
Action # Recorded Date Type Hit(s) User Expand Details
10137 5/10/2010 11:47:22 AM Server 1465 OWA Password Expiry Banner Some limitations to the Exchange 2007   More ...
10138 5/10/2010 11:47:22 AM Server 1615 Exchange 2007 Password Expiry Notification Email Requires: Quest   More ...
10136 5/10/2010 11:47:22 AM Server 1426 Applying the Proper Domain Structure to Password Policies It came  More ...
10120 5/3/2010 1:32:09 PM Server 1472 Review the assigned password policy to a user: Quest has a great  Collapse ...
Last Hit: Wednesday, October 18, 2017 6:21:43 PM

Review the assigned password policy to a user:

Quest has a great tool for learning which granular password policy is applied to a user.
-   Useful URLs:
   o   The "ActiveRoles Management Shell for Active Directory" can be downloaded from Quest at:
          - []
-   The command to learn which policy is applied:
   o   get-qaduser <USERNAME> -DontUseDefaultIncludedProperties -IncludedProperties 'msDS-ResultantPso' | ft 'msDS-ResultantPso'
          - The results will display the policy with the lowest cost
          - If no granular policy can be determined, it will display a blank list indicating the "Default Domain Policy"
   o   "exit" to close out the powershell

After removing our last Windows 2003 DC and promoting our environment to Windows 2008 Native (Both domain [A.D. Users and Computers] & forest [A.D. Domain and Trusts] levels, as we are a single domain), establishing multiple policies was relatively easy.
-   Some useful URLs are:
   o   []
   o   []
-   Create "Global" - "Security" groups and assign your members
   o   i.e. "All Students", "Technology Staff" & "All Staff," you may use existing groups and group nesting is allowed (i.e. A student in "Grade 09" nested in "All Students" will receive the password policy assigned to "All Students," assuming the precedence setting sets it as priority). A precedence setting, mentioned below, will determine which policy is actually applied when multiple policies are affiliated to a user.
-   Set, review and confirm your default password policies in the "Default Domain Policy," when a user is not affiliated to a security group assigned one of the granular password policies, they will default to the "Default Domain Policy."
-   Create your new password policies using ADSI editor
   o   Open your "Default naming context []"
   o   Expand "DC=yourdomain,DC=com" - "CN=System" - "CN=Password Settings Container"
   o   Right click on "CN=Password Settings Container" & select "New" - "Object"
   o   Select the only class present "msDS-PasswordSettings" and click "Next"
   o   The following will be a "Wizard" to set up the initial parameters of the password policy
          - Common-Name (CN) | Whatever you want to call the new policy
          - msDS-PasswordSettingPrecedence | The lower the cost level, the higher the priority
                + i.e. A policy with 10 will beat another policy assigned to the same user that has a cost of 20
          - msDS-PasswordReversibleEncryptionEnabled | Generally "False"
                + Storing passwords in reversible encryption is like storing passwords in clear text, but is sometimes required for some third party apps
          - msDS-PasswordHistoryLength | How many passwords to remember? i.e. a setting of 5 would be the last 5 passwords used are not permitted
          - msDS-PasswordComplexityEnabled | Up to you "True" or "False" - will require a password with at least one attribute from at least three of the following areas
                + Lower-Case
                + Upper-Case
                + Numerical 0 through 9
                + Special Character like !@#$%
          - msDS-MinimumPasswordLength | A setting of 8 would require the password be at least 8 characters long
          - msDS-MinimumPasswordAge | If you change your password now, how long are you required to wait before you can change it again
                + A value of "-864000000000" would equal a 1 day wait before you could change your password again
                + A value of "0" will set this to "None"
          - msDS-MaximumPasswordAge | How long until you will be required to change your password again
                + Using the above value for 1 day "-864000000000" & multiplying it by the # of days. i.e. "-864000000000" * 30 days = "-25920000000000"
                + A value of "-9223372036854775808" will set this to "Never" - you cannot set this to "None" or "0"
          - msDS-LockoutThreshold | How many failed attempts before locking an account - i.e. "5" continuous failed password attempts will lock the account
          - msDS-LockoutObservationWindow | How long before the reset of the counter for a failed password attempt
                + i.e. 10 minutes would be "-6000000000"
                + A value of "0" will set this to "None"
          - msDS-LockoutDuration | How long before the account will automatically unlock itself
                + i.e. 30 minutes would be "-18000000000"
                + A value of "0" will set this to "None"
   o   Click finish to create your policy and then right click it and select properties
   o   Click "Filter" and ensure that "Show only attributes that have values" is unchecked
   o   Look for the attribute "msDS-PSOAppliesTo" - this attribute is used to link the password policy to the security group it will apply to, edit the properties of this item and "Add Windows Account" search out your affiliated Global/Security group and add it to the list
   o   Review the other attributes set in the wizard, note that instead of those negative numbers mentioned above for the durations, you will now see them as dd:hh:mm:ss, I find it is easier to just type some random negative number during the wizard and then follow-up with the exact time after in the policy properties

Profile IMG: Footer Left Profile IMG: Footer Right