Combat Windows 2008 Multi-meta password policy

Source: Internet
Author: User

There is only one set of password policies in the windows2000/2003 domain, the default domain security policy, which does not set different password policies for each domain user, and a multiple password policy in the Windows2008 domain, which enables us to implement multiple sets of password policies in the same domain environment

Before implementing a multiple password policy, we need to upgrade the domain functional level to Windows 2008 or Windows 2008R2

This is the default domain security policy, you can see that the password policy does not have any restrictions, that is to say, my current domain users can set the password length arbitrary, can be a pure letter, can also be a pure number

In this experiment, I want to set the minimum user password length in the IT department OU to 8 bits, enable the user in the Human Resources OU to have the complexity password, and maintain the status of the user password in the Sales OU

But the multiplex password policy cannot be applied to OUs and can only be applied to global security groups or users, so we need to establish corresponding departmental global security groups in each OU and then subordinate individual users to this group

1. Create a global security group

Create a new global security group "IT department" in the OU "IT department"

To open the properties of the IT department group, add member "Qianqingqiu"

In the same way, create a new global security group, human resources, in the OU Human Resources department, and add the members "Zhao"

Create a new global security group Sales department in the OU Sales department and add member "Wang Xiaoting"

2. Create Password Settings object (PSO)

Multiple password strategies can be implemented in two ways, one is ADSI editor and the other is a more intuitive tool fine grain Password Policies Tool

Here we first create a password policy that applies to the IT department through the ADSI Editor, Open ADSI Editor on a domain controller, and right-click to select "Connect to"

Select "Default Naming Context"

Expand to Cn=password settings Container, right-click New object, and create a new Password setting object (PSO)

Set the PSO name

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.