KBY Technologies Logo
Active Directory · Windows PowerShell 5.1

Domain password policy and fine-grained password policies

What does the default domain password and lockout policy say, and which fine-grained password policies override it, for whom, and in what order?

Script

#Requires -Modules ActiveDirectory
# Default domain password policy and all fine-grained password policies. Read-only.

$default = Get-ADDefaultDomainPasswordPolicy
$rows = @([pscustomobject]@{
    Policy                      = 'Default domain policy'
    Precedence                  = $null
    AppliesTo                   = 'All users without a fine-grained policy'
    MinPasswordLength           = $default.MinPasswordLength
    ComplexityEnabled           = $default.ComplexityEnabled
    PasswordHistoryCount        = $default.PasswordHistoryCount
    MaxPasswordAge              = $default.MaxPasswordAge
    MinPasswordAge              = $default.MinPasswordAge
    LockoutThreshold            = $default.LockoutThreshold
    LockoutDuration             = $default.LockoutDuration
    LockoutObservationWindow    = $default.LockoutObservationWindow
    ReversibleEncryptionEnabled = $default.ReversibleEncryptionEnabled
})

$rows += @(Get-ADFineGrainedPasswordPolicy -Filter * |
    Sort-Object Precedence |
    ForEach-Object {
        [pscustomobject]@{
            Policy                      = $_.Name
            Precedence                  = $_.Precedence
            AppliesTo                   = $_.AppliesTo -join '; '
            MinPasswordLength           = $_.MinPasswordLength
            ComplexityEnabled           = $_.ComplexityEnabled
            PasswordHistoryCount        = $_.PasswordHistoryCount
            MaxPasswordAge              = $_.MaxPasswordAge
            MinPasswordAge              = $_.MinPasswordAge
            LockoutThreshold            = $_.LockoutThreshold
            LockoutDuration             = $_.LockoutDuration
            LockoutObservationWindow    = $_.LockoutObservationWindow
            ReversibleEncryptionEnabled = $_.ReversibleEncryptionEnabled
        }
    })

$rows

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

A domain-joined machine with the Active Directory module (RSAT) installed.

Reading the output

  • The first row is the default domain policy. Every other row is a fine-grained password policy, sorted by Precedence (lower number wins when more than one applies to a user).
  • Per Microsoft, fine-grained policies apply only to global security groups and user objects. AppliesTo lists the distinguished names they are linked to.
  • Age and lockout values are time spans (days.hours:minutes:seconds). A MaxPasswordAge of 00:00:00 means passwords never expire under that policy.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Get-ADDefaultDomainPasswordPolicy (ActiveDirectory)Get-ADFineGrainedPasswordPolicy (ActiveDirectory)about_ActiveDirectory_ObjectModel (LastLogonDate, PasswordLastSet and the account flag properties)Configure fine grained password policies for Active Directory Domain ServicesSort-Object (Microsoft.PowerShell.Utility)ForEach-Object (Microsoft.PowerShell.Core)
All scripts