Password Settings Objects and Password Settings Containers
If you’re at the Server 2008 Domain Functional Level, you can set different password requirements for different groups through the “Fine-Grained Password Policies” feature. There is some lingo you should know if you go through this procedure, because Microsoft does not provide a handy wizard for setting the feature up. First, there’s the Password Settings Object, or PSO. This is an Active Directory object that contains the specifications for your group: things like the minimum password length, history uniqueness requirements, maximum password lifetime, and so forth. You typically use a tool such as ADSI Edit to create a PSO. Second is the Password Settings Container, or PSC. Also an AD object, the PSC contains one or more PSO’s, as you might expect. You can see the PSC using Active Directory Users and Computers; it’s in the System container. (Turn on the Advanced view.) To actually associate a PSO with a group, you can modify the PSO attribute “msDS-PSOAppliesTo”. This is a multivalue attribute, so you can specify multiple groups if you like. There’s also an attribute named “msDS-PasswordSettingsPrecedence” which defines the PSO’s rank if a group is associated with more than one PSO; lower numbers mean higher priority. The process is not a particularly simple one, but it’s the sort of thing that you may only have to do once on any given network. Maintaining the relevant group memberships, however, will be an ongoing task.
