FGP vs GPO

Question

FGP vs GPO

Alec Alderson 0

I was tasked with changing current default password policy and having admin/service accounts have a different password policy than the default one. I was told FGPP is the way to go with this. But am being told that it can be done with another GPO targeting those certain OU's. Is this possible or will I have to use FGP for those accounts needing a different password policy than the default one?

0 comments

2 answers

Your answer

Answer 1

Hello Alec,

Thank you for posting question on Microsoft Windows Forum!

Based on your query of Fine-Grained Password Policies (FGPP) vs Group Policy Object (GPO) for this specific task. Well! Active Directory has a strict rule regarding domain accounts. It only respects the password policy configured in a GPO linked to the Domain root (which is almost always the Default Domain Policy). If you create a new GPO with a stricter password policy and link it to an OU containing your admin or service accounts, AD will ignore it for those domain accounts. Instead, that OU-linked password GPO will only apply to the local accounts (the local SAM database) of any computer objects that happen to reside in that OU.

For Fine-Grained Password Policies, on the other hand, instead of relying on OU structure, FGPP utilizes Password Settings Objects (PSOs). These PSOs allow you to define completely different password requirements (length, complexity, history, and lockout settings) and apply them directly to specific Users or Global Security Groups. When a PSO is applied to a user or a group they belong to, it successfully overrides the Default Domain Policy for those specific accounts.

Therefore, for this specific task. You must use Fine-Grained Password Policies (FGPP). You cannot use a Group Policy Object (GPO) linked to an Organizational Unit (OU) to enforce a different password policy for domain user accounts.

You can consult the following article for configuring fine grained password policies..

https://learn.microsoft.com/th-th/windows-server/identity/ad-ds/get-started/adac/fine-grained-password-policies

Hope the above information is helpful! If it is. Free feel to hit "Accepted" for benefitting others in community having the same query too.

Answer 2

Use fine-grained password policies for different password/account lockout rules for specific users or groups in the same domain.

A separate GPO linked to an OU is not the supported way to give different domain user accounts a different password policy. Account policies can be defined in only one GPO linked to the domain, which is why password policy is configured in the Default Domain Policy for the domain-wide default. If those settings are configured in another GPO, they affect only local user accounts on the computers that receive that GPO, not domain user accounts.

For the requirement of keeping one default policy for most users and a stricter or different policy for admin/service accounts, FGPP is the correct approach:

Keep the domain-wide default password policy in the Default Domain Policy.
Create one or more fine-grained password policies (FGPPs).
Apply those FGPPs to the specific users or groups for admin/service accounts.
Set precedence so the custom FGPP overrides the default policy for those accounts.

In Active Directory Administrative Center, the FGPP path is: Tree View → domain → System → Password Settings Container → New → Password Settings.

Key point: OU targeting is for GPO scope, but password/account lockout exceptions for domain accounts are handled by Password Settings Objects / FGPP, not by linking another password-policy GPO to an OU.