Lion Cipher Lab
Enforce fine-grained password policies in Active Directory
- Identity & Access Management
- Intermediate
- ~60 min
- Free · no account required
Why it matters
For most of Active Directory's history a domain had exactly one password policy. It lived in the Default Domain Policy Group Policy Object, and it applied to every single account in the domain the same way — the receptionist, the summer intern, the backup service account, and the Domain Admin who can rewrite the whole directory all lived under identical rules. That is a genuine security problem, because those accounts are not equally dangerous. A stolen Domain Admin password can end the organisation; a stolen intern password usually cannot. Treating them identically means you either set the…
What you'll learn
- explaining what a Fine-Grained Password Policy (FGPP) and a Password Settings Object (PSO) are, and why an AD domain historically had only ONE password policy for everyone
- measuring the BEFORE state: reading the single domain-wide policy every account shares with Get-ADDefaultDomainPasswordPolicy
- creating a stricter PSO for a privileged group with New-ADFineGrainedPasswordPolicy (minimum length, lockout, precedence) and applying it with Add-ADFineGrainedPasswordPolicySubject
- measuring the AFTER state: proving with Get-ADUserResultantPasswordPolicy that an admin now resolves to the stricter PSO while a regular user still resolves to the domain default
- resolving precedence when a user falls under two PSOs (the lowest msDS-PasswordSettingsPrecedence wins) and predicting the resultant policy before you run the cmdlet
- recognising the honest limits: FGPP applies to users and GLOBAL security groups only (never OUs — you need a shadow group), it does not retroactively change existing passwords, and its controls are coarse
- judgment: where FGPP genuinely helps (a longer minimum length + sane lockout for privileged accounts), where it fights modern guidance (NIST SP 800-63B is against forced periodic expiry and composition rules), and why MFA beats aggressive rotation
Steps in this lab
- What a fine-grained password policy is, and the problem it solves
- Confirm the module, then MEASURE the before state (one policy for everyone)
- Create the privileged group and a stricter PSO
- Apply the PSO, then MEASURE the after state (admin vs regular user)
- Precedence: what happens when a user is caught by two PSOs
- The honest negatives: OUs, retroactivity, and coarse controls
- Do it better — when to reach for FGPP, when not, and what to pair it with
- Clean up, and the Linux alternative (Samba AD-DC)