"Loopz" <> wrote in message
news:...
>
> Best get a drink for this one! lol.
>
> We have just found out that the Password must meet complexity
> requirements isn’t working on the domain policy. After a lot of
> investigation we confirmed that the SID is registered as the original
> domain policy (it’s been renamed), that any changes in the USER section
> is being implemented and other changes in the COMPUTER section also
> works. btw...The domain policy is being linked at the domain level.
>
> Any changes to Account Policies / Password Policy are not being
> implemented. Enforce password history, maximum password age, minimum
> password age, minimum password length and Password must meet complexity
> requirements can all be changed but it doesn’t reflect on the users
> machine. I receive old value requirements if I manually try and change
> the password to 2 characters (for example) on the machine. Ie: password
> must be 6 characters etc…instead of 8 to what ive changed it to.
>
> Running GPO RSOP indicates that in the COMPUTER section, under
> Components Status, there is a failure in security. Error states
> “Security has requested to process its policy settings again.” Checked
> the Policy events and there is an error Event Id : 1202 “security
> policies were propagated with warning 0x5: Access is denied”. I’m just
> wondering if this is actually more referring to the driver signature
> part and nothing to do with the password attribs.
>
> This is a single forest, single domain running in mixed mode 2000 with
> 3 Domain Controllers all running windows 2003. We used to be 2 DC’s
> running 2000 and 1 running 2003. All the roles etc were running on the
> 2000 DC’s and they were decommissioned (roles transferred) to the new
> 2003 DC servers. This happened a few months back and I’m not sure if
> this would have played a part.
>
> Gpresult on the machine (or machines) indicates it’s being applied,
> although we know that because other settings are being changed and being
> reflected as tests. Double checked other things like dcdiag / replmon
> just to check all looks well there and it does. I’m really stuck and
> there could be something stupid I haven’t considered. Any help would be
> grateful. If you need any information then let me know. Here is the
> winlogon.log
>
> Winlogon.log
><snipped>
>
> --
> Loopz
> ------------------------------------------------------------------------
Basically for a password policy to work, the domain needs to be in at least
Native mode. For more info, please read the following.
Event ID 1000 and event ID 1202 are logged to the event log every five
minutes in Windows 2000 Server
http://support.microsoft.com/kb/319352
If it still doesn't work after changing it to Native mode, then it appears
there may have been a security policy placed (either through Security and
Analysis, or a template was imported to the domain policy), or some other
method was used to alter or create policies. Read the following, if this is
the case.
Group Policy Is Not Applied and You Receive No Error Message
http://support.microsoft.com/kb/310741
Read the following for more possibilities if the above are not helpful.
http://eventid.net/display.asp?event...SceCli&phase=1
--
Ace
This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.
Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.
Ace Fekay, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA
2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.
Similar Threads
Linear Mode
