Multiple Password Policies in Active Directory

🔒 Secure Bits 💡
𝗡𝗲𝗲𝗱 𝗠𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗣𝗼𝗹𝗶𝗰𝗶𝗲𝘀 𝗶𝗻 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆?

Many admins try to enforce different password rules via GPOs on OUs — only to find out it doesn’t work.

𝗪𝗵𝘆?
🔹 GPO password policy applies only to computer objects.
🔹 Each domain supports only ONE account policy — applied at the domain root.

So how do you apply different rules for different users?

✅ 𝗙𝗶𝗻𝗲-𝗚𝗿𝗮𝗶𝗻𝗲𝗱 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗣𝗼𝗹𝗶𝗰𝗶𝗲𝘀 (𝗙𝗚𝗣𝗣)
FGPP lets you create multiple password policies targeted at users or groups — without touching your GPO password policy.

💡 𝗘𝘅𝗮𝗺𝗽𝗹𝗲 𝗨𝘀𝗲 𝗖𝗮𝘀𝗲:
🔹 Users → 12 characters (Enforced by GPO)
🔹 Admins → 17 characters (Enforced by FGPP)

🛡 𝗛𝗼𝘄 𝘁𝗼 𝘀𝗲𝘁 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗹𝗲𝗻𝗴𝘁𝗵?
You can follow:
🔸 CIS Benchmark:
→ 14 characters minimum
🔸 NIST SP 800-63
→ 8 characters minimum
🔸 Czech regulation (Vyhláška 82/2018):
→ Users → 12 chars
→ Admins → 17 chars
→ Service accounts → 22 chars

FGPP is configured in 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗔𝗱𝗺𝗶𝗻𝗶𝘀𝘁𝗿𝗮𝘁𝗶𝘃𝗲 𝗖𝗲𝗻𝘁𝗲𝗿.

🔗 Want to learn more like this? 𝗖𝗵𝗲𝗰𝗸 𝗼𝘂𝘁 𝗼𝘂𝗿 𝗔𝗗 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗰𝗼𝘂𝗿𝘀𝗲:
👉 https://academy.horizon-secured.com/p/active-directory-password-policies

How are you handling password policies in your environment? 👇