Configure Fine-Grained Password Policies in Active Directory

Fine-Grained Password Policies (FGPPs) let you apply different password and account lockout settings to different sets of users in the same Active Directory domain. This is useful when one domain-wide policy is not enough, for example when privileged or service accounts need different controls from standard user accounts.

FGPPs were introduced with Windows Server 2008. For currently supported Windows Server versions, Microsoft documents them for Windows Server 2025, 2022, 2019, and 2016, with a domain functional level of Windows Server 2012 or higher.

In This Article

• 1. What Is a Fine-Grained Password Policy?
• 2. Requirements and Scope
• 3. Understand Precedence
• 4. Configure an FGPP with ADAC
• 5. Configure an FGPP with PowerShell
• 6. Verify the Resultant Policy
• 7. Key Takeaways

1. What Is a Fine-Grained Password Policy?

The default domain password policy applies broadly across the domain. An FGPP adds another layer by creating a Password Settings Object (PSO) with its own password and account lockout settings.

A PSO can define settings such as minimum password length, password history, password age, complexity, lockout threshold, lockout duration, and lockout observation window. This allows multiple password policies to coexist in one domain.

2. Requirements and Scope

• The domain functional level must be Windows Server 2012 or higher according to current Microsoft guidance.
• FGPPs apply directly to user objects and global security groups.
• You cannot apply an FGPP directly to an Organizational Unit (OU). If you want policy scope to follow a set of users, use a global security group.
• Domain Admins can manage FGPPs by default, although administration can be delegated.
• Use Active Directory Administrative Center (ADAC) or the Active Directory PowerShell module to manage the policies.

3. Understand Precedence

Each FGPP has a Precedence value. When multiple policies are applicable, a lower precedence number has higher priority. For example, a policy with precedence 10 has higher priority than one with precedence 20.

It is a good idea to leave gaps between precedence values, such as 10, 20, and 30, so another policy can be inserted later without renumbering everything. Do not rely only on the policy list when troubleshooting. Always check the resultant policy for the user.

4. Configure an FGPP with ADAC

To create a policy with Active Directory Administrative Center:

1. Open Active Directory Administrative Center by running dsac.exe.
2. Open the target domain, then go to System > Password Settings Container.
3. In the Tasks pane, select New > Password Settings.
4. Enter a name and precedence value, then configure the password and lockout settings required for your environment.
5. Under Directly Applies To, add the required user or global security group.
6. Save the Password Settings Object.

For most environments, assigning the PSO to a dedicated global security group is easier to manage than assigning it directly to individual users.

5. Configure an FGPP with PowerShell

The following example creates a policy named Engineering-PSO. The values below are examples only; use settings that match your organization’s security requirements.

New-ADFineGrainedPasswordPolicy -Name "Engineering-PSO" `
-Precedence 20 `
-ComplexityEnabled $true `
-MinPasswordLength 14 `
-PasswordHistoryCount 24 `
-MinPasswordAge "1.00:00:00" `
-MaxPasswordAge "90.00:00:00" `
-LockoutThreshold 5 `
-LockoutDuration "00:15:00" `
-LockoutObservationWindow "00:15:00" `
-ReversibleEncryptionEnabled $false

New-ADFineGrainedPasswordPolicy -Name "Engineering-PSO" `
-Precedence 20 `
-ComplexityEnabled $true `
-MinPasswordLength 14 `
-PasswordHistoryCount 24 `
-MinPasswordAge "1.00:00:00" `
-MaxPasswordAge "90.00:00:00" `
-LockoutThreshold 5 `
-LockoutDuration "00:15:00" `
-LockoutObservationWindow "00:15:00" `
-ReversibleEncryptionEnabled $false

Assign the policy to a global security group:

Add-ADFineGrainedPasswordPolicySubject -Identity "Engineering-PSO" -Subjects "GG-Engineering-Users"

Add-ADFineGrainedPasswordPolicySubject -Identity "Engineering-PSO" -Subjects "GG-Engineering-Users"

Check the policy and the users or groups to which it is directly assigned:

Get-ADFineGrainedPasswordPolicy -Identity "Engineering-PSO"

Get-ADFineGrainedPasswordPolicySubject -Identity "Engineering-PSO"

Get-ADFineGrainedPasswordPolicy -Identity "Engineering-PSO"

Get-ADFineGrainedPasswordPolicySubject -Identity "Engineering-PSO"

6. Verify the Resultant Policy

This is the most important validation step. A user can be associated with more than one PSO through direct assignment or group membership, but only one policy becomes the resultant password policy.

Use the following command to see the policy that actually applies to a user:

Get-ADUserResultantPasswordPolicy -Identity "user01" | Format-List Name,Precedence,*Password*,*Lockout*

Get-ADUserResultantPasswordPolicy -Identity "user01" | Format-List Name,Precedence,*Password*,*Lockout*

You can also select the user in ADAC and use View Resultant Password Settings. When troubleshooting an unexpected password or lockout setting, verify the resultant policy instead of assuming that the lowest-numbered PSO you see is the one in effect.

7. Key Takeaways

• FGPPs allow multiple password and account lockout policies within a single Active Directory domain.
• They apply directly to users and global security groups, not directly to OUs.
• A lower precedence number means higher priority.
• Group-based assignment is usually easier to manage than assigning policies user by user.
• Use Get-ADUserResultantPasswordPolicy to confirm which policy actually applies to a user.

References

• Microsoft Learn – Configure fine-grained password policies for Active Directory Domain Services
• Microsoft Learn – New-ADFineGrainedPasswordPolicy
• Microsoft Learn – Get-ADUserResultantPasswordPolicy

Ceyhun Kirmizitas

Cloud and infrastructure professional with nearly two decades of experience in enterprise IT environments, spanning public cloud, private cloud, and hybrid architectures.