Default Domain Policy - Change to Password Enforcing

[PreviousPoster]

Good Morning,

Hopefully this is a easy one to answer but I am yet to find the answer. Currently we have our password policy bundled into the Default Domain Policy. This enforces the password must be 7 characters, complex etc etc.

We are looking to change the strength to from 7 to 8 characters. Question is, if we change this in GP, when users pick up the new policy if they have a password tha is 7 characters will it lock there accounts, force them to change the password on next logon or leave the updates till the next time the password needs to be changed?

Regards

James

[JerryC]

Our experience is that the End User systems will wait until the next time each user is required to change their password (we have 160,000+ users, so we understand your concern).

If they are required to change their password every three months, then it'll take three months to implement (or six months, or 45 days, ... basically whatever you've configured the maximum password age to be).

Good question!

[jdobiash]

That has been my experience as well. When we implemented complex passwords it only took effect the next time they had to change their password. I suppose you could lower your Max Password Age down, but then people would have to change them more frequently.