Applies to: Windows Server 2019, Windows Server 2022, and Windows Server 2025.
Fine-grained password policies apply different password and lockout settings to selected domain users and global security groups.
Prerequisites
- Administrative access to the affected Windows Server hosts.
- A tested backup or documented rollback point.
- An approved maintenance window for production systems.
Step-by-step configuration
- Define the business requirement and select a global security group.
- Create a password settings object with a unique precedence.
- Assign the policy to the approved group.
- Check the resultant password policy for a test user.
- Monitor lockout events after rollout.
PowerShell and command-line procedure
New-ADFineGrainedPasswordPolicy -Name "Privileged-Accounts" -Precedence 10 -ComplexityEnabled $true -MinPasswordLength 16 -PasswordHistoryCount 24 -MaxPasswordAge 45.00:00:00 -LockoutThreshold 5 -LockoutDuration 00:30:00 -LockoutObservationWindow 00:30:00
Add-ADFineGrainedPasswordPolicySubject -Identity "Privileged-Accounts" -Subjects "GG-Privileged-Users"
Get-ADUserResultantPasswordPolicy -Identity test.admin
Verification
Get-ADUserResultantPasswordPolicy returns the intended PSO for each pilot user.
Rollback
Remove the group assignment and then remove the PSO after confirming users receive the expected domain policy.
Security and operational guidance
- Apply least privilege and document every production change.
- Test the procedure in an isolated environment before broad deployment.
- Replace all example names, paths, and TEST-NET addresses with approved production values.
- Monitor relevant Windows event logs after the change.
Related resources
Deploy or manage Canadian Windows VPS infrastructure with networkmanager.info. Validate production decisions against the official Microsoft Windows Server documentation.
