Fine-Grained Password Policies: How to Set Them Up in Active Directory

This guide explains how to create Fine-Grained Password Policies (FGPP) in Active Directory, which allow different password and account lockout rules for specific users or groups within one domain. FGPPs can only be applied to user objects and global security groups, and the domain functional level must be Windows Server 2012 or later. Administrators need Domain Admins membership and either the Active Directory Administrative Center or the Active Directory PowerShell module. The article walks through creating a policy in the Password Settings Container, noting that lower precedence values take higher priority. Finally, it shows how to verify which policy applies to a user using the Get-ADUserResultantPasswordPolicy PowerShell command.