Posted on: August 20th, 2010 by Famous Phil

This is an annoyance that I constantly have to look at 2 sources to remember so I’ve decided to consolidate my 2 sources into a single blog that I can refer to in the future. Basically, every time I set up a new Server 2008 R2 box to act as an Active Directory domain controller, I always run into passwords having to be complex and changed every 42 days by default. This is an annoyance because users don’t like having to do that so frequently. The location to change this isn’t in a common sense location either.

To change the policy, goto your start menu and in the search area (provided it will run commands), type in “gpmc.msc” and hit enter.  This will bring up the Group Policy Management Console.  Expand the local forest that you want to modify the password policy for.  Expand Domains, and the domain that you wish to modify.  Right click on Default Domain Policy and click edit.  This will bring up a new screen.  You want to navigate to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Password Policy.  From this screen, you will be able to modify the password policy.  You can either reboot or type in a new command “gpupdate /force” and the new settings will take over.

I don’t recommend disabling features such as complexity because your users will then be able to use passwords such as “letmein, password, changeme”, etc.  These are insecure passwords and those who use them are simply asking to get their accounts compromised.

Also, the solution above will not work if you have a password window open that is forcing you to use a complex window, you will have to go through that wizard again.  This also won’t reverse the force password changes on next login if a user needs to change their password due to the old policies.

Tags: active directory, domain controller, password complexity, password policy, server 2008 r2
Posted in Hosting / Server Administration
|| 1 Comment »