How exactly password policies works?

hi everyone,

i'm struggling understanding of password policies in domain before fine-grained password policies.

it seems password policies account in ad taken default domain policy gpo if gpo not linked anywhere , "supplement" gpo password settings linked top of domain.

are password settings taken default domain policy? happen if delete gpo?

is behavior change forest level or after fine grained policy implemented?

if have article explain of grateful.

thank you

> if have article explain of grateful.

 

there's no article on that, facts are:

 

you can have password policies in gpos linked on ou

structure. evaluation of these policies follows simple rules:

 

any member computer apply password policies in gpos linked

ou. not apply password policies linked domain. , these

password policies applied local accounts on computer.

 

all dcs except 1 holds pdc emulator fsmo role not

apply password policy. regardless of linked or if

they enforced or else - non pdce dcs not apply password

policies.

 

the pdc emulator apply password policies linked domain

itself, , domain - not apply password policies linked

to ou ("domain controllers"). these password policies applied

domain accounts.

 

hope sheds light :-))

 

btw: same true kerberos policies.

 

Windows Server  >  Directory Services