AD Fine-Grained Password Policy Ignored When Applied to a Group

Symptom

A Password Settings Object (PSO) exists and appears to be applied, yet users still receive the Default Domain Policy password rules.

Typical observations: a user in the targeted group can set a password that the PSO should reject, or the PSO’s lockout and length values do not match what the user experiences.

False Assumption

The common assumption is that applying a PSO to any group, including a convenient distribution or domain local group, makes every member subject to it. The PSO tool accepting the entry is not proof that the policy is in force.

A second assumption is that the most restrictive PSO wins. Selection is by precedence, not strictness.

Root Cause

Fine-grained password policies apply to users and to global security groups, not to other group scopes or types. A PSO linked to a group of the wrong scope or type is stored but never resolved for its members.

When several PSOs apply, the one with the lowest precedence value wins. A PSO linked directly to a user generally takes priority over one linked through group membership. Confirm exact resolution rules in the Active Directory documentation for your Windows Server version.

Impact

Privileged or service-adjacent accounts silently remain on weaker domain-wide settings, so the intended length, history or lockout controls are not enforced. This is a medium-severity gap because it is invisible until audited, and it creates a false sense of compliance.

Diagnosis

Start read-only. Ask Active Directory what policy it resolves for a specific user rather than inspecting the PSO alone.

1. Run Get-ADUserResultantPasswordPolicy for an affected user. An empty result means no PSO applies, so the Default Domain Policy is in force.
2. List PSOs with Get-ADFineGrainedPolicy and note each Precedence and AppliesTo value.
3. Check the target group’s GroupScope and GroupCategory. Anything other than Global and Security explains the failure.
4. Check the user’s direct PSO links and membership in other targeted groups for a lower precedence value.

Related reading: LDAP signing not required on domain controllers covers another case where a setting looks applied but is not enforced, and No LAPS and shared local admin hashes covers the related credential exposure.

Correction

Link the PSO to a global security group that contains the intended users, either by creating a new group or by nesting the existing members into it. Nesting behaviour should be confirmed in the vendor documentation for your version, so link users directly if in doubt. Give each PSO a unique, deliberate precedence value.

Changes should be made in a non-production domain first, with a permissioned account, and recorded before and after. Stop if the resultant policy for a test user is not the one you expected.

Validation

Success is Get-ADUserResultantPasswordPolicy returning the intended PSO name and values for a sample of users, including one with multiple matching PSOs.

Then attempt a password change in the test environment with a value that violates the PSO and confirm it is rejected.

Rollback

To undo, remove the new link from the PSO (or restore the previous AppliesTo value you recorded) and remove any group membership you added. Re-run the resultant policy check to confirm users return to their earlier policy.

Do not delete the PSO during rollback unless a human reviewer approves, because it may be needed for other targets.

Prevention

• Create PSOs against global security groups only, by standard.
• Keep a precedence register so no two PSOs share a value.
• Add a recurring check that runs the resultant policy query for representative privileged accounts.
• Review PSO changes alongside domain controller replication health, since stale replication can also delay policy changes.

Next Safe Decision

If every sampled user resolves to the intended PSO, close the change. If any returns empty, fix group scope before adjusting policy values. Confirm version-specific behaviour in the Active Directory documentation listed in the sources.