Password history settings in GPO seems not propagated

[libroos]

Hi,

Recently (two months ago), there's an update to the password expiry in domain policy from 30 days to 60 days. Users are listed directly under the Users folder in the main office.abc.com forest. They should follow the domain policy.

However, there are a lot of users whom reported that they still need to change password every 30 days. I've checked the ADUC, the domain policy and it's 60 days.

How do I go about applying the 60 days password expiry to all users?

Pls advise. Thks.

Rgds,
libroos

 

[Titleist]

libroos,

You should install the acctinfo.dll from the resource kit.

http://www.petri.co.il/view_additional_user_information_in_aduc.htm

With this you can view when users last set their password, when it's going to expire and a few other goodies. Your users might not be right..

John

 

[libroos]

Thx John. I've used Hyena to view the account info for the reported users and it's true.

I've checked the domain policy, it's 60 days,however end users are still at 30 days.

 

[markdmac]

Unless I am mistaken, I believe that the policy won't take effect on those users until AFTER they reset their password. Their expiration dates were already set in AD when you increased the time frame.

Simple enough to verify. Have one suer change their password and check the new expiration date.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[libroos]

Thx Mark.

It's still the same. After tested on one of end-users account, the password expiry is still 30 days, though the GPO, domain policy is still showing 60 days.

I've also run gpupdate.exe on end-user's workstation, but still the same.

I may be testing out on no over-ride policy and put some test users into the OU for testing.

Rgds,
libroos

 

[Titleist]

Where did you apply this policy? It only works at the domain level not at an OU.

John

 

[libroos]

Forest. I've checked both domain security policy and the domain policy. It's 60 days, however, end users are still using 30 days.

Strange.

Why is that so?

 

[markdmac]

Sounds like the registry is tattooed on a PC. Try manually deleting the policies from the registry on the workstations and then do a gpupdate /force.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.