Why Use Fine-Grained Password Policies?
Historically, Active Directory only allowed one password policy per domain, meaning regular users and high-privileged IT administrators were forced to share the same password complexity and expiration rules. Fine-Grained Password Policies (FGPP) solve this by allowing you to create multiple Password Settings Objects (PSOs) and apply them directly to specific users or security groups, ensuring that privileged accounts are held to much stricter security standards.
Step 1: Open the Active Directory Administrative Center
Log in to your Domain Controller. While FGPP could previously only be configured via complex ADSI Edit or PowerShell commands, modern Windows Server versions include a graphical interface. Open the Active Directory Administrative Center (ADAC) from the Server Manager Tools menu.
Step 2: Navigate to the Password Settings Container
In the left-hand navigation pane of ADAC, click on your domain name (e.g., contoso (local)) to expand it. Double-click the System container, and then double-click the Password Settings Container.
Step 3: Create a New Password Settings Object
In the Tasks pane on the far right, click New and then select Password Settings. A dialog box will appear allowing you to define the new policy.
Step 4: Configure the Policy Attributes
Fill out the policy details based on your security requirements:
- Name: Give the policy a descriptive name (e.g., “Admin-Strict-Policy”).
- Precedence: Set an integer value (e.g., 10). If a user is a member of multiple groups with different PSOs, the policy with the lowest precedence number wins.
- Password Length/Complexity: Enforce stricter rules, such as a minimum length of 16 characters and requiring history retention.
- Account Lockout: Configure aggressive lockout thresholds (e.g., lock the account after 3 invalid attempts).
Step 5: Apply the Policy to a Group
At the bottom of the Password Settings window, look for the Directly Applies To section. Click the Add… button. Search for and select the specific Active Directory Security Group you want this policy to apply to (e.g., “Domain Admins” or “IT Staff”).
Click OK to save and activate the policy. Members of that group will now immediately be subject to the new, stricter password requirements without affecting the rest of the domain.