Each PSO must have a precedence index number.

When implementing FGPPs, there are several things to think about before creating and applying FGPPs.

Select the PSO you want to delete. Click Delete.įine-grained Password Policy Best Practices.In the ADAC, go to System → Password Settings Container.Viewing Resultant Settings in a PSO Editing a PSO Click the Start button and type dsac.exe.From the drop-down menu, select Active Directory Administrative Center. Click the Start button and type Server Manager.Click the Start button and type Active Directory Administrative Center.The following are some ways to open the ADAC: Method 1: The ADAC gets installed automatically when the Active Directory Domain Services (AD DS) role is installed for Windows Server 2012 domain controllers and above. ADAC in Windows Server 2012, comes with enhanced fine-grained password policy features, allowing administrators to create and manage PSOs. The Active Directory Administrative Center is a Windows PowerShell based command-line interface through which administrators can easily perform data management and routine IT tasks from a single console having a visually appealing GUI. Managing Password Setting Objects (PSO) Active Directory Administrative Center (ADAC) To learn more about fine-grained password policies, click here. Instead, they use the specified PSO settings. When a PSO is applied to a user, the user no longer uses the password policy deployed by Group Policy. To apply different settings to sets of users, administrators need to create a new PSO and configure the settings as per requirement. A PSO contains all the same password settings that exist in all other GPOs. FGPPs widen the scope of password security by having multiple password policies within a single domain.įine-grained password policies are deployed using password settings objects (PSOs). Fine-grained password policy and PSOįine-grained password policy (FGPP) brings with it the capability of setting different password and account lockout policies for different sets of users in the same domain, thus making the AD environment more secure. Some accounts demand a stronger password policy than others for obvious security reasons. Administrators are well aware of the fact that users and groups occupy different levels of their organization’s hierarchy and do not all have the same privileges.

Set up a new password policy gpo