Implementing password change 1

[ZipperHeadMan]

Hi,

I would like to force a password change every 120 days, via Active Directory.

Do I have to configure a computer or user GPO to achive this?

If its a computer GPO, than how does AD recognize if a user has already been prompted to change their password?

 

[porkchopexpress]

Password policy can only be set at the domain root level for user accounts and it is set in the user config area.

 

[porkchopexpress]

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/bpactlck.mspx

 

[Loki1973]

porkchopexpress is right, but do not be fooled: You can set the security settings on every GPO level, but only the domain one will apply.

 

[porkchopexpress]

Sorry that was a lie it is set in the computer config are of the domain policy.

 

[porkchopexpress]

Oh yes good point Loki1973 that can be very confusing, i think OU level settings will affect local user accounts but not domain accounts.

 

[ZipperHeadMan]

Hey thanks you two,

So, if I disable the password settings in the default domain GPO and configure a new GPO and link it to an OU further down the tree, will that work? or will the default domain GPO overide? I want to test this on a few machines first..not the whole domain. What you think?

Second...if this is a computer GPO, what happens if a user has access to two or more PC's? Will they be prompted to change their passwords again...I don't want this to happen!
Can you elaborate?

Your insight is appreciated
TREE

 

[porkchopexpress]

No i'm almost certain the only place that you can set this is in the Default Domain Policy or one linked at the same level. You will have to test it in a lab setup i'm afraid.

The policy is set in the computer area of the policy but the info is stored in the Active Directory so they will only be prompted once.

 

[ZipperHeadMan]

Great!

Any thoughts on how I can force a "user must change password at next logon" across the masses?

Apart from configuring this on each user object, can automate is for an entire OU of users? or am I out of luck?

TREE

 

[porkchopexpress]

Can you not highlight whole OU's of users then select it?

 

[ZipperHeadMan]

Yes you're right, I can.
But only in AD not after a user object search.

Thanks

 

[ZipperHeadMan]

How about implementing a grace login period like Novell supports. Does such an option exist in Windows?

 

[porkchopexpress]

The script center might help.

http://www.microsoft.com/technet/scriptcenter/scripts/ad/users/pwds/uspwvb12.mspx