一、前言:
Windows Server 2008提供了新的 [Fine-Grained Password Policies]來處理這類的需求。要使用這個功能必須網域的功能等級先提昇為Windows Server 2008等級，接著透過AD網域中新的[Password Settings Container]的位置來進行設定，這個位置可使用[AD Users and Computers]管理工具，使用[Advanced Features]來開啟System位置就可看到，不過您必須要使用[Adsiedit.msc]或[Ldifde]工具來設定!
二、做法:
1. 請先建立一個全域安全性群組，例如：GSGroup1.
2. 將您想要排除的Account加為GSGroup1的成員.
3. 建立PSO
4. To create a PSO using ADSI Edit
- Click Start, click Run, type adsiedit.msc, and then click OK.
- In the ADSI Edit snap-in, right-click ADSI Edit, and then click Connect to.
- In Name, type the fully qualified domain name (FQDN) of the domain in which you want to create the PSO, and then click OK.
- Double-click the domain.
- Double-click DC=<domain_name>.
- Double-click CN=System.
- Click CN=Password Settings Container.
All the PSO objects that have been created in the selected domain appear.
- Right-click CN=Password Settings Container, click New, and then click Object.
- In the Create Object dialog box, under Select a class, click msDS-PasswordSettings, and then click Next.
- In Value, type the name of the new PSO, and then click Next.
- Continue with the wizard, and enter appropriate values for all mustHave attributes.
Attribute sample:
|
Attribute name |
Description |
Acceptable value range |
Example value |
|
msDS-PasswordSettingsPrecedence |
Password Settings Precedence |
Greater than 0 |
10 |
|
msDS-PasswordReversibleEncryptionEnabled |
Password reversible encryption status for user accounts |
FALSE / TRUE (Recommended: FALSE) |
FALSE |
|
msDS-PasswordHistoryLength |
Password History Length for user accounts |
0 through 1024 |
24 |
|
msDS-PasswordComplexityEnabled |
Password complexity status for user accounts |
FALSE / TRUE (Recommended: TRUE) |
TRUE |
|
msDS-MinimumPasswordLength |
Minimum Password Length for user accounts |
0 through 255 |
8 |
|
msDS-MinimumPasswordAge |
Minimum Password Age for user accounts |
· (None)
· 00:00:00:00 through msDS-MaximumPasswordAge value |
1:00:00:00 (1 day) |
|
msDS-MaximumPasswordAge |
Maximum Password Age for user accounts |
· (Never)
· msDS-MinimumPasswordAge value through (Never)
· msDS-MaximumPasswordAge cannot be set to zero |
42:00:00:00 (42 days) |
|
msDS-LockoutThreshold |
Lockout threshold for lockout of user accounts |
0 through 65535 |
10 |
|
msDS-LockoutObservationWindow |
Observation Window for lockout of user accounts |
· (None)
· 00:00:00:01 through msDS-LockoutDuration value |
0:00:30:00 (30 minutes) |
|
msDS-LockoutDuration |
Lockout duration for locked out user accounts |
· (None)
· (Never)
· msDS-LockoutObservationWindow value through (Never) |
0:00:30:00 (30 minutes) |
|
msDS-PSOAppliesTo |
Links to objects that this password settings object applies to (forward link) |
0 or more DNs of users or global security groups |
“CN=u1,CN=Users,DC=DC1,DC=contoso |
12. On the last screen of the wizard, click More Attributes.
13. On the Select which property to view menu, click Optional or Both.
14. In the Select a property to view drop-down list, select msDS-PSOAppliesTo.
15. In Edit Attribute, add the distinguished names of users or global security groups that the PSO is to be applied to, and then click Add.
16. Repeat step 15 to apply the PSO to more users or global security groups.
17. Click Finish.
5. To apply PSOs to users or global security groups using the Windows interface
- Open Active Directory Users and Computers. To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
- On the View menu, ensure that Advanced Features is checked.
- In the console tree, click Password Settings Container.
Where?
- Active Directory Users and Computers\domain node\System\Password Settings Container.
- In the details pane, right-click the PSO, and then click Properties.
- Click the Attribute Editor tab.
- Select the msDS-PsoAppliesTo attribute, and then click Edit.
- In the Multi-valued String Editor dialog box, enter the Distinguished Name (also known as DN) of the user or the global security group that you want to apply this PSO to, click Add, and then click OK.
請選擇您在先前已定義好的群組(GSGroup1)。
三、注意事項:
透過PSO物件的屬性設定來套用，極可能會有衝突的情形產生（多個PSO設定到單一物件），因此PSO有一個重要屬性[msDS-PasswordSettingsPrecedence]!
這屬性是一個1以上的整數值，越低的數字代表有較高的排序（優先權），例如有兩個PSO分別的屬性值為10與20，10的優先權比較高因此會真的套用到物件上；此外，如果屬性值一樣的話，那就以PSO的GUID比較小的會套用!
另外如果有分別的PSO設定到使用者帳戶與使用者所隸屬群組的話，則套用到使用者帳戶的才是結果PSO!
參考資訊連結：
AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide
http://technet.microsoft.com/en-us/library/cc770842.aspx
