The Importance of Password Expiration Policies
Enforcing a password expiration policy is a critical security measure in any Active Directory environment. By requiring users to change their passwords periodically, you mitigate the risk of compromised credentials being used indefinitely. Windows Server Group Policy provides a centralized way to enforce these rules across your entire domain.
Step 1: Open Group Policy Management
Log in to your Windows Server domain controller. Press Win + R, type gpmc.msc, and press Enter to open the Group Policy Management Console.
Step 2: Edit the Default Domain Policy
Password policies must be applied at the domain level to affect domain user accounts. Expand your domain, right-click the Default Domain Policy, and select Edit.
Step 3: Navigate to Password Policy Settings
In the Group Policy Management Editor, navigate to the following path:
Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy
Step 4: Configure the Expiration Settings
In the right-hand pane, you will see several policy settings. Double-click on Maximum password age.
- Check the box for Define this policy setting.
- Enter the number of days a password can be used before it expires (e.g., 90 days).
- Click Apply and OK.
You can also configure the Minimum password age (e.g., 1 day) to prevent users from rapidly changing their password multiple times to bypass password history requirements.
Step 5: Force the Policy Update
Once configured, the policy will automatically propagate to all computers in the domain. To enforce it immediately, open an elevated Command Prompt and execute:
gpupdate /force