Configure Fine-grained Password Policies In Windows Server 2008

So called fine-grained password policies are a new feature of Windows Server 2008. This new feature allows system administrators to configure password policies for different user groups. Windows Server 2003 was not as flexible as it only allowed to set one password policy for all users. The manual configuration of fine-grained password policies requires quite some time. A software program like Specops Password Policy Basic is therefor a handy addition for every system administrator dealing with Windows Server 2008 systems.

The free program is a limited version of the commercial software from the same developer. It requires the Microsoft .net Framework 2, the Microsoft Management Console and PowerShell. The interface of the application makes it less time consuming to configure password policies for specific user groups in Windows Server 2008. It basically centers around creating, configuring and managing password policies.

The following parameters can be defined for each password policy:

A Password Settings object (PSO) has attributes for all the settings that can be defined in the Default Domain Policy (except Kerberos settings). These settings include attributes for the following password settings:

• Enforce password history
• Maximum password age
• Minimum password age
• Minimum password length
• Passwords must meet complexity requirements
• Store passwords using reversible encryption
• Account lockout duration
• Account lockout threshold
• Reset account lockout after

User groups can be added to newly created policies. It has to be noted that user groups cannot be empty as empty user groups cannot be added to password policies. The program displays an overview of all password policies on the computer system. The order can be changed which is important if users are members of multiple user groups.

Specops Password Policy Basic can be downloaded from the developer’s homepage.

Related Articles:

Author: Martin Brinkmann, Wednesday May 20, 2009 -
Tags:fine-grained password policy, password, password policy, specops password policy, system administrator, windows server, windows server 2008, windows software