Windows Server 2025 / How to Configure Password and Account Lockout Policies
Domain password and account lockout policies govern password requirements and repeated failed sign-ins. Distinguish the domain default from Fine-Grained Password Policies (FGPP): linking a normal GPO to a user OU does not create a separate domain password policy for that OU.
Identify default and fine-grained scope
A fine-grained policy uses a Password Settings Object (PSO). This exercise leaves the existing domain default unchanged and targets a dedicated lab group. FGPP guidance describes supported users and global security groups; an OU itself is not a target.
Get-ADDefaultDomainPasswordPolicy Get-ADUserResultantPasswordPolicy -Identity 'labuser1' Get-ADFineGrainedPasswordPolicy -Filter *
If another PSO already applies, examine precedence and the resultant policy before adding one.
Choose isolated targets and sample values
Use GG_LabUsers and ordinary labuser1 in ad.example.test, excluding privileged, service, and real user accounts. These numbers demonstrate behavior, not a universal organizational security baseline:
| Setting | Lab example |
|---|---|
| Minimum length and complexity | 14 characters; complexity enabled |
| History | 5 passwords |
| Minimum and maximum age | 0 and 30 days |
| Lockout threshold | 5 failures |
| Lockout and observation window | 15 minutes each |
| Reversible encryption | Disabled |
Operational choices depend on detection, multifactor authentication coverage, account type, and recovery. Very low lockout thresholds can inconvenience users or enable denial of service. Length and expiration alone do not describe overall account protection.
Create and assign the PSO
Run with appropriate AD permissions on DC1 or a management PC with the AD module, only if the policy name is unused. Check New-ADFineGrainedPasswordPolicy parameters:
$policyParameters = @{
Name = 'Lab-Password-Policy'
Precedence = 100
MinPasswordLength = 14
ComplexityEnabled = $true
PasswordHistoryCount = 5
MinPasswordAge = (New-TimeSpan -Days 0)
MaxPasswordAge = (New-TimeSpan -Days 30)
LockoutThreshold = 5
LockoutDuration = (New-TimeSpan -Minutes 15)
LockoutObservationWindow = (New-TimeSpan -Minutes 15)
ReversibleEncryptionEnabled = $false
}
New-ADFineGrainedPasswordPolicy @policyParameters
Add-ADFineGrainedPasswordPolicySubject -Identity 'Lab-Password-Policy' -Subjects 'GG_LabUsers'
Get-ADUserResultantPasswordPolicy -Identity 'labuser1'
The GUI alternative is Active Directory Administrative Center → domain → System → Password Settings Container. Create the settings, assign GG_LabUsers, and view the user’s resultant policy. Do not create the same policy twice.
Test a new password rather than inspecting the old string
Changing policy does not retroactively lengthen a stored password. First confirm the expected resultant PSO, then use the normal password-change screen as labuser1 on CLIENT1. Keep all passwords out of logs and screenshots.
Do not repeatedly mistype an administrator’s password to demonstrate lockout. Investigate stale credentials in tasks, services, and saved connections when a user keeps locking out:
Get-ADUser -Identity 'labuser1' -Properties LockedOut,PasswordLastSet | Select-Object SamAccountName,LockedOut,PasswordLastSet
Unlocking an account does not remove the source of repeated failures. Verify the user and resolve the cause before a targeted unlock rather than relaxing policy or unlocking every user.
Remove the assignment and verify the fallback
Remove only the lab group’s assignment when finished:
Remove-ADFineGrainedPasswordPolicySubject -Identity 'Lab-Password-Policy' -Subjects 'GG_LabUsers' Get-ADUserResultantPasswordPolicy -Identity 'labuser1' Get-ADDefaultDomainPasswordPolicy
If no other PSO applies, the domain default governs and the resultant-PSO query may show none. Removal does not restore an earlier password; retain the valid new password securely. Check for other targets before deleting the PSO, or keep it unassigned if it will be reused.
