How do you configure a domain password expiration policy?

Answer 1

Configuring a Password Expiration Policy in Existing Domain (Change Password Policy Settings):

Open the Active Directory Users and Computers snap in while logged in to the domain controller as an administrator.

• Right-click the root domain name and select properties.
• Navigate to the Group Policy tab and choose "Edit" for the default policy
• Expand the policy folder: Windows Settings > Security Settings > Account Policies

Choose the Password Policy key, and change settings to as appropriate for your environment.

Go back up a level and then select the Account Lockout Policy key, and change settings as appropriate for your environment.

Your password change policy is now active in the domain, and will affect all user objects that are not set explicitly with "do not expire password".

A WORD OF CAUTION IN EXISTING DOMAINS: Keep in mind that once you enable the password expiration policy in an existing domain, you run the risk of immediately expiring all user passwords that have not been set with "do not expire password" on their account properties. This can cause a huge support nightmare. Before you enable the password expiration policy be sure to go through AD and set all staff user accounts with "do not expire password" under the "account" tab of the user properties. Then you can safely enable the above policies without affecting users.

Use a good pre planning and expiration reminder tool! Get something like Password Reminder PRO from SysOp Tools (http:/www.sysoptools.com) which will automatically send a reminder email to expiring password users and let them know when their password will expire, and will also allow you to clean up your AD before policy deployment. It is a great inexpensive tool that will save you a lot of work!

Use a good use support tool to reduce help desk load! The first two password change periods for users carry the highest support overhead as users get used to changing their password and creating a complex password. Any tools you can give them to make life easier will result in lower support calls and happier users / IT staff.

Typically, deploying an easily accessible web-based self service solution which allows users to self change password, self reset password or self unlock account is a great way to go. Look at something easy to deploy and inexpensive like Password Reset PRO from SysOp Tools.

Answer 2

A domain password is very important for user because it secured your information. After expiring your domain name password you should renew. A password must be initially assigned to a user when enrolled on the system. You should manage your password before expire.