Скачать или смотреть GPO password policy in an Active Directory

Update the Domain Password Policy (GPO)
Open Group Policy Management
On a DC or management server:
gpmc.msc
Expand:

Forest
└─ Domains
└─ yourdomain.local

Edit the Policy

⚠️ Best practice:

Edit “Default Domain Policy” for password settings
(Microsoft recommendation for domain-wide password rules)

Right-click Default Domain Policy → Edit

Navigate to Password Settings
Computer Configuration
└─ Policies
└─ Windows Settings
└─ Security Settings
└─ Account Policies
└─ Password Policy

Common Password Policy Settings
Setting Recommended Value
Enforce password history 24
Maximum password age 60–90 days
Minimum password age 1 day
Minimum password length 12–14
Password must meet complexity requirements Enabled
Store passwords using reversible encryption Disabled

💡 Complexity requires:

Uppercase
Lowercase
Number
Special character

3️⃣ Account Lo
Navigate to:

Account Policies
└─ Account Lockout Policy

Setting Example
Account lockout threshold 5 invalid attempts
Account lockout duration 15 minutes
Reset account lockout counter after 15 minutes
4️⃣ Deploy / Apply the GPO
Force Update (Optional but Immediate)

On a Domain Controller:

gpupdate /force

On a client or user machine:

gpupdate /force

5️⃣ Verify the Policy Is Applied
On a Domain Controller
net accounts

On a Client (RSOP)
rsop.msc

or:

gpresult /r

6️⃣ Important Notes (Very Common Gotchas)

⚠️ Password policies only apply to:

Domain user accounts

Not local users

⚠️ OU-linked GPOs do NOT control passwords

Password policy must be linked at domain level

⚠️ Changing the policy:

Does not force immediate password changes

Users are forced to comply at next password change

7️⃣ Optional: Fine-Grained Password Policy (FGPP)

Use this if:

Admins need stronger passwords

Service accounts need different rules

Created via:

Active Directory Administrative Center (dsac.exe)


I can walk you through FGPP if needed.