Combat Windows 2008 Multi-meta password policy

There is only one set of password policies in the windows2000/2003 domain, the default domain security policy, which does not set different password policies for each domain user, and a multiple password policy in the Windows2008 domain, which enables us to implement multiple sets of password policies in the same domain environment

Before implementing a multiple password policy, we need to upgrade the domain functional level to Windows 2008 or Windows 2008R2

This is the default domain security policy, you can see that the password policy does not have any restrictions, that is to say, my current domain users can set the password length arbitrary, can be a pure letter, can also be a pure number

In this experiment, I want to set the minimum user password length in the IT department OU to 8 bits, enable the user in the Human Resources OU to have the complexity password, and maintain the status of the user password in the Sales OU

But the multiplex password policy cannot be applied to OUs and can only be applied to global security groups or users, so we need to establish corresponding departmental global security groups in each OU and then subordinate individual users to this group

1. Create a global security group

Create a new global security group "IT department" in the OU "IT department"

To open the properties of the IT department group, add member "Qianqingqiu"

In the same way, create a new global security group, human resources, in the OU Human Resources department, and add the members "Zhao"

Create a new global security group Sales department in the OU Sales department and add member "Wang Xiaoting"

2. Create Password Settings object (PSO)

Multiple password strategies can be implemented in two ways, one is ADSI editor and the other is a more intuitive tool fine grain Password Policies Tool

Here we first create a password policy that applies to the IT department through the ADSI Editor, Open ADSI Editor on a domain controller, and right-click to select "Connect to"

Select "Default Naming Context"

Expand to Cn=password settings Container, right-click New object, and create a new Password setting object (PSO)

Set the PSO name