Richardjgreen.net Website Review

This post isn’t going to set the world on fire because of it’s revelations and new features; instead, I am going to talk about a feature that has been around since Windows Server 2008 called Fine Grained Pas*word Policies. Active Directory Pas*word Policies are, even in 2018, still misunderstood. For all the consulting engagements I do, I still encounter customer environments where admins have tried to configure multiple Group Policy Objects to control pas*word policy at various levels within their OU structure. An example of this behaviour would be to set the Default Domain Policy object to a standard pas*word complexity and then have an OU containing administrative accounts for Domain Admins which has a GPO applying a more complex policy. Before we go any further then, let’s set the record straight. In a standard configuration AD domain there can be only one pas*word policy. It matters not where or how many times you try to link and create GPOs to set different policies, it will not work. In a default AD domain, the pas*word policy is configured in the Default Domain Policy which is applied at the root, the top-level of the domain. The pas*word policy is enacted and controlled by the Domain Controllers not by the computer or user object of a client. In the modern era of PowerShell, we can see that the default pas*word policy for the domain is by using the GET-ADDEFAULTDOMAINPAS*WORDPOLICY PowerShell command which outputs similar to the screenshot below. In this example, the lockout duration and observation windows are 15 minutes each, accounts are locked out after five failed attempts and pas*words must be at least seven characters long, meet complexity requirements, be no older than 90 days but more than 1 day old, and the previous 12 pas*words are Enter Windows Server 2008 R2 which brought with it a feature, as part of Active Directory, called Fine Grained Pas*word Policies. What this new feature allows us to do, at last, it to have control over the pas*word policy for specific users or groups. Want uber complex admin