AZ-802: Administering Windows Server

In Active Directory Domain Services, the Password Policy, Account Lockout Policy and Kerberos Policy settings are domain-wide account policies: domain controllers always read them from the Group Policy Object linked at the root of the domain, so a single password policy governs every domain user account in that domain. Placing those same settings in a GPO linked to an organizational unit does not create a second password policy for the domain accounts inside that OU; the only supported way to give different domain users different password requirements is a fine-grained password policy (a Password Settings Object), which applies exclusively to user objects and global security groups and cannot be targeted at an OU at all. Consequently, a 14-character minimum defined in a GPO linked to the OU that holds an administrator's user account has no effect on that administrator's domain password, which remains governed by the 10-character minimum set at the domain root; and a standard domain user elsewhere in the same domain is likewise bound by that 10-character domain-root minimum.

An account policy configured below the domain level is not inert, however. Microsoft documents that when these settings are set at any level below the domain in AD DS, they affect the local accounts on the member servers concerned: the account policy settings for an OU are applied to the local security policy of every computer object contained in that OU, and are enforced whenever someone signs in with an account from that computer's own local account database. A GPO that sets a minimum password length of 8 and is linked to the OU containing the member servers therefore does control the local SAM of those servers, so a local user account created on a server in that OU must be given a password of at least eight characters, even though the same GPO cannot change the password requirements of any domain account. Note also that a member server's effective default minimum password length is only seven characters, so the eight-character requirement is the result of the OU-linked policy rather than a Windows default.

Reference: "Account Policies" and "Minimum password length" in the Windows security policy settings documentation, and "Configure fine grained password policies for Active Directory Domain Services in Windows Server" on Microsoft Learn.