How to check if GP password policy is working?

[gregfranklin]

I have about 60 users on our domain, all policy changes work fine but what I want to check is if our 90 day password change policy is working. We set this up about 30 days ago but the security auditors need to verify this policy is working.

Everything is properly set up in the Default Domain Group Policy >> Computer configuration, Windows settings, security settings, password policy.

How do I check this?

Thanks!

 

[wdoellefeld]

You need to steer the auditors into the right mode of thinking. Instead of focusing on the 90 days, switch focus to prove that the method of implementing the policy is working. Put a test account in a test OU and apply a policy (with no override) for a password change every day. Let them see it working which in turn means your 90 day is working. Then explain the importance of not changing the default policy for your company for a simple "proof" test which does nothing but aggravate your users and make them lose productivity.

Sarbanes-Oxley suxxors.

FRCP

http://www.frcp.net

 

[buddafish]

password policy only applies at the domain level, not ou. i do agree with wdoellefeld not to change the policy for proof, but if that's what has to happen, just roll the number down on the password policy. get ready to assist with all the password changes. make certain that the "never expire" is not checked for users that must change password.

scottie