Clients Ignoring GPO (password complexity/length)

[mikrowiz]

I am trying to implement the complex password policy and character length for passwords, but my clients are ignoring them and I can't for the life of me figure out why. RSOP returns all the proper results on a client. It shows the proper GPO settings, yet a user can set a password as stupid as "dog" even though RSOP shows Password Complexity is Enabled. For all intensive purposes it appears that the security settings in the Default Domain Policy are getting applied, just not adhered to. Junk from the User settings seems to be getting applied just fine, just not the Computer settings. I even tried resetting the Default Domain Policy dcgpofix /targetomain with no joy Anyone?

 

[mlichstein]

Where are you setting the password policy? The password policy can only be set at the domain level, and only in the Default Domain Policy.

Grammar Nazi:

For all intensive purposes...

For all intents and purposes

/Grammar Nazi

 

[mikrowiz]

Yes. I know. That is where I'm setting it, and it appears to be working according to RSOP when it is run on one of the clients as it shows the complexity and length (8 characters) are enabled. Even though the resultant policy shows that though, I can still set a 3 character all lowercase password. It's quite irritating. Almost as irritating as someone correcting an oft misused cliche when there are bigger problems to be solved

 

[mlichstein]

Have you refreshed policy on the domain controllers. They're the only machines that really matter when it comes to setting passwords.

 

[mikrowiz]

You mean with a gpupdate /force? If so, I did try that but it didn't change anything. I can't find anything on either the DC's or the clients that shows why this shouldn't be working properly.

 

[mikrowiz]

Found it. Block Inheritance was turned on on the domain controller OU for some reason. Even though clients showed the right policy, the DCs weren't getting the policy, and therefore not enforcing it, because it was blocked to them.