Starting with Windows Server 2008 administrators can define more than one password policy in a single
domain by implementing a fine grained password policies.
These give you individual control over user password requirements and you can have different password
requirements for different users and groups.
This is beneficial for enforcing more restrictive password settings for administrators.
Service accounts or users with highly critical business functions to support their fine grained password
policy feature Edit Yes and Windows Server 2008 and newer include two object types.
Password settings container and peer SOS password certain container is created in Windows Server by
default until you can view it in the domain system container.
The container stores the peer SOS that you create and link to global security groups or to users.
As for PSU members of the domain Edmonds group read peer SOS and then define specific password and account
lockout settings to link to a specific security group or user.
Now find green password policies only applied to user objects iiNet or a person objects or global security
groups by linking a peer so to a user or a group you are modifying an attribute called a mass DNS dash
P S O applied which is empty by default.
This approach now treats passwords and account block out certainly not as the main white requirements
but as attributes of a specific user or a group for example to configure a strict password policy for
administrative accounts.
Create a global security group at the Administrative user accounts as members and then link peer so
to a group plan.
Fine grained password policies to a group in this manner is more manageable then applying policies to
each individual user account.
If you create and use service account you simply added to Group and the P S O manages the account by
default.
Only members of the domain Edmonds group can create and apply fine grained password policies.
However you also can duplicate the ability to set these policies to other users on a domain by domain
basis.
Now let's talk about applying fine grained password policies you cannot apply a fine grained password
policies directly to an O you to apply a fine grained password policy to owe you users you can use a
shadow group a shadow group is a global security group that maps logically to an O U and enforces a
fine grained password policy you can add an o use users as members of the newly created shadow group
and then you can apply the fine grained password policy to this shadow group.
If you move a user from one o you to in other you must update the membership of the corresponding shadow
groups.
The sentence that fine grained password policies manage are identical to those whom the password policy
and account policy nodes of a GPO.
However you know that implement fine grained policy password policies as part of group policy nor are
they applied as part of a GPO instead the P O is a separate class of object in a tedious that maintains
the sentence for fine grained password policy.
Additionally fine grained password policies do not interfere with custom passwords Saturns or filters
that you might have implemented.
You can create one or more peer source in your domain.
Each contains a complete set of password and lockout policies sentence and each allows the same configuration
options.
The are available in domain based password and lock out sentence you apply appear P.S. so by linking
it to one or more global security groups or users to use their fine grained password policy your domain
functional level must be at least Windows Server 2008 which means that all of your domain controller
is in the domain must be running at least Windows Server 2008 to meet this condition.
You must raise the domain functional level to at least Windows Server 2008 to confirm and modify the
domain functional level.
Use the following procedure.
Open Active Directory domains and trusts in the council 3 expand Active Directory demands and trusts
and then expand the 3 until you can see the domain.
Right click the domain and then click res domain functional level.
Okay next stop will be talking about tools for creating O's.
As you remember an abbreviation PSU means password Saturns objects.