Fine-grained Password Policy
Planted .
Last tended .
Can be done using ADAC or PowerShell. We need to set all values that need to be set, including those that might be coming from domain.
ADAC
- Click on Domain > System > Password Settings Container > New > Password Settings.
- Set values as needed.
- Under Directly Applies To, choose Add, type the name of the group to which the fine grained password policy, and then choose OK.
Powershell
Create policy
$policyParams = @{
Name = "PasswordPolicy"
ComplexityEnabled = $true
LockoutDuration = "00:30:00"
LockoutObservationWindow = "00:30:00"
LockoutThreshold = "0"
MaxPasswordAge = "42.00:00:00"
MinPasswordAge = "1.00:00:00"
MinPasswordLength = "7"
PasswordHistoryCount = "24"
Precedence = "1"
ReversibleEncryptionEnabled = $false
ProtectedFromAccidentalDeletion = $true
}
New-ADFineGrainedPasswordPolicy @policyParams
Assign policy
Add-ADFineGrainedPasswordPolicySubject PasswordPolicy -Subjects group1
references:
Create Fine Grained Password Policy (Step-by-Step-Guide) - Active Directory Pro
Configure fine grained password policies for Active Directory Domain Services in Windows Server | Microsoft Learn