In this post we look at how to display which Fine Grain Password Policy (FGPP) is being applied to a user.
Fine Grain Password Policies were introducted in Windows 2008, and provide the ability to define different password policies that can be assigned to users or members of a group. The assigned FGPP will take precedence over the default domain policy, and can be used to provide a different settings depending on your requirements, this could be used to have a more strict password policy for admin accounts.
The FGPP configuration is stored in a Password Security Object or PSO and multiple PSO can be created with different settings. These are stored in the Password Settings Container under the default name context i.e CN=Password Settings Container,CN=System,DC=w2k12,DC=local.
A user can be assigned multiple FGPP, but only one will be active and used to control the user password requirements. The msDS-PSOApplied attribute is used to list all the PSO that are assigned directly to user or group objects. The msDS-ResultantPSO attribute is used to show which FGPP is being applied to the user.
NetTools is able to display the FGPP polices and which FGPP is allocated to a user. (Version 1.30.7 and above required)
If we search for a user using the Quick Search field on the toolbar.
From the search results if we double click on the user's account and open the AD properties dialog, the Logon tab, shows which Fine Grain Policy is being applied and the Fine Grain Password tab shows the settings of that policy.
