The Limitation of the Default Domain Policy
In older versions of Windows Server, a domain could only have one single password policy. If you edited the “Default Domain Policy” to require 8-character passwords, it applied to everyone from the receptionist to the Domain Admins. If you wanted Admins to have 15-character passwords, you were forced to create a completely separate Active Directory domain. Fine-Grained Password Policies (FGPP) solve this by allowing you to create multiple, highly specific password requirements and apply them directly to different security groups within the exact same domain.
Step 1: Open the Active Directory Administrative Center (ADAC)
FGPP cannot be managed using the traditional Group Policy Management Console. You must use the newer ADAC tool.
Log in to your Domain Controller, open Server Manager, click Tools, and select Active Directory Administrative Center.
Step 2: Navigate to the Password Settings Container
In the left-hand navigation pane of ADAC, click on your domain name (e.g., corp (local)).
In the center pane, double-click the System folder, and then double-click the Password Settings Container. (If you do not see this folder, ensure your Domain Functional Level is set to Windows Server 2008 or higher).
Step 3: Create a New Password Settings Object (PSO)
Right-click in the empty center pane, select New, and click Password Settings.
A graphical window will appear allowing you to define the exact parameters of this new policy.
- Name: Give it a descriptive name (e.g., “IT-Admin-Strict-Policy”).
- Precedence: Set an integer (e.g., 10). If a user accidentally receives two different policies, the policy with the lower precedence number wins.
- Minimum password length: Change this to a high number for admins (e.g., 15).
- Password complexity: Ensure this is checked.
- Account lockout policy: You can define custom lockout thresholds here (e.g., lock the account after 3 failed attempts).
Step 4: Apply the Policy to a Security Group
Scroll down to the bottom of the Password Settings window to the Directly Applies To section.
Click the Add button. Search for the Active Directory security group you want this policy to affect (e.g., Domain Admins or IT-Helpdesk). Never apply FGPP directly to individual users; always use groups.
Click OK to save the new policy.
Step 5: Verify the Policy is Applied
The policy takes effect immediately; no reboot or gpupdate is required because this is a direct Active Directory object, not a GPO.
To verify which policy is currently applying to a specific user, stay inside the Active Directory Administrative Center. Use the Global Search to find a specific Admin user account. Right-click their account and select View resultant password settings. The console will display your new “IT-Admin-Strict-Policy”, confirming that this user is now forced to use a 15-character password, while the rest of the company remains on the 8-character Default Domain Policy.