Share via

AD Password Change solutions?

Eaven HUANG 2,156 Reputation points
2024-07-07T02:30:48.39+00:00

Dear Experts,

We are considering hardening our account security by enforcing a password change for users every 90 days. I noticed that in GPO, this policy is available under Computer Configuration only, so I'm a bit lost on how to implement this solution. I thought it should be applied to the user accounts directly?

In our scenario, we also use Office 365 and EntraID (formerly known as AAD), where users can reset their passwords online, and these changes are written back to our local DC. How can we connect these systems together to ensure a seamless password management experience?

Any advice and suggestions would be greatly appreciated.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,571 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,185 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marcin Policht 17,615 Reputation points MVP
    2024-07-07T11:38:55.7333333+00:00

    You apply it in the Default Domain Policy GPO. This will effectively enforce the configuration for all users in the domain (unless you also implement Fine Grained Password Policy). Details in https://activedirectorypro.com/how-to-configure-a-domain-password-policy/

    For Entra ID, as per https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy

    Password expiry duration (Maximum password age) Default value: 90 days. If the tenant was created after 2021, it has no default expiration value. You can check current policy with Get-MgDomain. The value is configurable by using the Update-MgDomain cmdlet from the Microsoft Graph module for PowerShell.|

    If you already implement password writeback in Entra ID, then this is all that's required.

    If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

    hth

    Marcin