Q: I recently noticed that I can specify short or even blank passwords for local accounts—even the administrator account—on member servers despite the fact that the Default Domain Policy for our domain requires passwords to be at least eight characters and the Require passwords to meet complexity requirements feature to be enabled. I thought that domain-level settings overrode a computer’s local policy. Why isn’t that happening in this case?
A: The value defined for any policy (e.g., the minimum password length defined as eight) in Group Policy Objects (GPOs) overrides any value defined for the same policy in the computer’s local policy object. A computer’s local policy takes effect only if no applicable GPO in Active Directory (AD) has a defined value for a given policy. However, more than one GPO in AD might define a value for the same policy. For example, one GPO might define eight as the minimum password length while another GPO might define 0. . . .
Register
