{"id":967,"date":"2016-07-20T13:13:44","date_gmt":"2016-07-20T03:13:44","guid":{"rendered":"https:\/\/girl-germs.com\/?p=967"},"modified":"2016-07-22T07:34:47","modified_gmt":"2016-07-21T21:34:47","slug":"fgpps-psos-translated-yay-more-domain-password-control","status":"publish","type":"post","link":"https:\/\/girl-germs.com\/?p=967","title":{"rendered":"FGPP’s & PSO’s – translated: “Yay! More domain password control!”"},"content":{"rendered":"

I’ve previously spoken about security and password management\u00a0(if you need a refresher, I’m referring to this post<\/a> and this post<\/a>) however I neglected to go into detail regarding one really cool and amazing thing – Fine-Grained Password Policies & Password Setting Objects…and I’ve been promising to write this post for months!<\/p>\n

I know a lot of this can be found on the MS TechNet site, but I hope to inject a bit of real world “this is why we did things the way we did them” into this, so it gives you a better understand of how they can be applied and what the settings do.<\/p>\n

Now, FGPP’s aren’t new. They’re not something that’s just been released. They’ve been around for\u00a0quite a while – it’s just that many admins out there don’t seem to know they exist. So trust me, once you’ve played around with FGPP’s, you won’t want to go back…<\/p>\n

FGPP’s & PSO’s<\/u><\/b><\/p>\n

FGPP’s are, quite simply, the best thing ever for domain passwords (notice I said\u00a0domain<\/strong> there, not local…LAPS is in a league of it’s own and I’m in the process of writing a piece on that too!) and it can make a huge difference to the security of your environment. Being able to have multiple password policies in your environment means flexibility without the need for compromising security.<\/p>\n

For those who aren’t aware of FGPP’s (and quoting\u00a0directly from Microsoft<\/a>):
\n“You can use fine-grained password policies to specify multiple password policies within a single domain. You can use fine-grained password policies to apply different restrictions for password and account lockout policies to different sets of users in a domain.”<\/p>\n

Yes, you read it right folks – it lets you have\u00a0multiple password policies<\/strong> within the one domain. This makes life so much easier, especially if you’re doing the right thing and having your desktop, server and domain admin accounts have decently long and complex passwords!<\/p>\n

Example uses<\/strong><\/span><\/p>\n

So, a few examples – and I’m actually going to pull these from my experience in setting up, as these are policies we currently have in place at the moment (or are trying to get put in place!):<\/p>\n