password policy not working

[0bs]

hey! folks....i need urgent help. here is my situation. i just implemented stronger password policy through group policy in windows 2003 server. i'm running a windows domain network. i configured group policy to force password change after 90 days, password must be atleast 6 characters, and i also checked the option for "password must meet complexity requirement". i enabled all my users to change password at next logon. Users are using win XP and 2k workstations to log into domain.what is happening is that my users are getting the prompt to change password, and everything seems to be working fine for most, but the not too smart ones are not following the instructions on the screen. They are entering new password, but leaving the confirm password section blank, then they click ok, and actually get a "password changed". They login, but next time they logoff and try to login with the new password they thought they changed, it does not work, but they can login with a blank password to the network...very strange.

For some reason the password policy is not enforcing properly. All help greatly appreciated. thanks.

 

[mlichstein]

There are three boxes they need to fill out when they change their password: old password, new password, and new password confirm.

Are you saying that they put their old password, then a new password, but leave the new password confirm blank, and it works??

 

[0bs]

yeah.....it works. they actually can log on with blank password. I'm scratching my head trying to figure how is that possible.

 

[mlichstein]

That doesn't make any sense. If they type in a password, and then confirm it with a blank password, it should never be accepted. Those are two completely different passwords.

 

[martyh]

do an RSOP on one of the users/machines that this has happened on and click on the tab that shows what was applied (sorry, don't have that capability here).

Marty
Network Admin
Hilliard Schools

 

[hirdesw]

You need change account security settings in the default domain policy not on an other policy wich is designated for a ou. It only works in the default domain policy