Can different groups in Windows 2000/2003...

[Shyatic]

Have different password requirements? I need to know if I can set one group, say the Managers to have strong passwords at least 7 letters long, and then regular users to have a regular password with only 5 characters minimum.

Possible? How do I accomplish it? And do you have any articles detailing how to do it?

Thanks!

[Takhisis]

You could use OU's and give each OU a different policy.

[Shyatic]

Splain in english please :)

I'm just doing research for my boss. If you have some links that detail this... then that would rule.

[Takhisis]

In active directory you can create Organistional Units.

Open Active directory users and computers.

Right click your domain

Select New/Organistaion Unit

This will create a new OU, name the group appropriately (it can be changed later)

Set up the policy for this OU as you would the normal Users folder, but making the policy changes you need.

Finally add all of the users who are to have the new policy into the OU folder.

The next time the users logon they will be under the control of the new policy.

[Takhisis]

I think the below link explains some of it further:

OU Link

[Shyatic]

My boss is saying that the 'strong' password setting is a global policy and can't be used for an OU... is he correct or not? I just need some information to verify and if you have a link, that'd rule :)

[+BudMan MVC]

here is the thing - yes you can make changes to the OU policy for passwords, but those will only effect the local policies of machines in that OU. They will NOT affect domain accounts.

So even though you can set a OU that contains your admins to use complex, if the domain Policy says that you do not need complex - then any domain account they have will not be forced to use complex passwords. But local accounts they have on the servers in the OU that sets a complex password, would be inforced.

So yes you can set local policies of computers in your domain to enforce complex passwords for their local accounts, but you can not enforce complex passwords on some domain accounts - and not others. Atleast without some 3rd party software.

http://msdn.microsoft.com/library/default....n-us/gp/615.asp

By default, Account Policies (Password, Lockout, and Kerberos settings) are all defined in the Default Domain GPO. Since Domain Controllers are responsible for enforcing these domain-wide policies, Domain Controllers always receive these settings from the Default Domain GPO. Furthermore, since Password and Lockout Policies are defined in the Default Domain GPO, all Windows 2000 machines in that domain obtain the same password and lockout policies for their local Security Accounts Manager (SAM) database even though they have their own default local account policies defined. This happens because domain-level policies have precedence over local policies. Note that it is possible to specify a different local password policy on workstations or servers by including those workstations or servers in an OU which has its own account policy settings. This is because an OU policy has precedence over a domain policy.