Password Policies and Protected Users.
Now,
the trend with passwords nowadays is to have your users change their
passwords less frequently, but ensure that when they do change their
password, they're choosing a sufficiently strong one.
Traditionally in Active Directory, we configured password
policy at the domain level using Group Policy.
And this approach originated, as I mentioned a moment ago, before
Active Directory when we had Windows NT domains.
Now a problem emerged with Active Directory,
which dates back to around 1999 or so with Windows 2000 server, is that
for businesses that do have different groups of users who have
different security requirements, this would sometimes force an
organization to have a multi‑domain forest because you could only do
password policies at the domain level.
Now, honestly,
nowadays in 2022, Microsoft recommends a single
domain forest for a business anyway.
I mean,
look at it. When you're going to a multi‑domain
forest or a multi‑domain tree forest,
you're dramatically increasing the complexity of that environment.
You really don't need to do this because you can scale to virtually
unlimited number of accounts within a single domain.
Now,
let's compare the Group Policy domain password policy
with fine‑grained password policy. Here,
we have separate password policies that are attached to Active Directory groups.
What if somebody belongs to more than one AD group,
each of which has a fine‑grained policy? Well, as administrators,
we can associate a precedence value that resolves conflicts and
makes sure that the highest precedence policy will be the one
that's effective for that user.
So, I mean, it's not overly complex,
but it's a nice solution to that domain limitation
that we outlined a moment ago.
We configure fine‑grained password policies in Windows server,
either with Active Directory Administrative Center, or we can do so programmatically with Windows PowerShell.