Skip to content

ADFineGrainedPasswordPolicy

dscbot edited this page Apr 30, 2022 · 2 revisions

ADFineGrainedPasswordPolicy

Parameters

Parameter Attribute DataType Description Allowed Values
Name Key String Specifies an Active Directory fine-grained password policy object name.
Precedence Required UInt32 Specifies a value that defines the precedence of a fine-grained password policy among all fine-grained password policies.
DisplayName Write String Specifies the display name of the object.
Description Write String Specifies the description of the object.
Subjects Write StringArray[] Specifies the ADPrincipal names the policy is to be applied to, overwrites all existing.
Ensure Write String Specifies whether the fine-grained password policy should be present or absent. Default value is 'Present'. Present, Absent
ComplexityEnabled Write Boolean Specifies whether password complexity is enabled for the password policy.
LockoutDuration Write String Specifies the length of time that an account is locked after the number of failed login attempts exceeds the lockout threshold. The lockout duration must be greater than or equal to the lockout observation time for a password policy. The value must be a string representation of a TimeSpan value.
LockoutObservationWindow Write String Specifies the maximum time interval between two unsuccessful login attempts before the number of unsuccessful login attempts is reset to 0. The lockout observation window must be smaller than or equal to the lockout duration for a password policy. The value must be a string representation of a TimeSpan value.
LockoutThreshold Write UInt32 Specifies the number of unsuccessful login attempts that are permitted before an account is locked out.
MinPasswordAge Write String Specifies the minimum length of time before you can change a password. The value must be a string representation of a TimeSpan value.
MaxPasswordAge Write String Specifies the maximum length of time that you can have the same password. The value must be a string representation of a TimeSpan value.
MinPasswordLength Write UInt32 Specifies the minimum number of characters that a password must contain.
PasswordHistoryCount Write UInt32 Specifies the number of previous passwords to save.
ReversibleEncryptionEnabled Write Boolean Specifies whether the directory must store passwords using reversible encryption.
ProtectedFromAccidentalDeletion Write Boolean Specifies whether to prevent the object from being deleted.
DomainController Write String Specifies the Active Directory Domain Services instance to connect to.
Credential Write PSCredential Specifies the user account credentials to use to perform this task.

Description

The ADFineGrainedPasswordPolicy DSC resource will manage an Active Directory domain's fine grained password policies.

Requirements

  • Target machine must be running Windows Server 2012 or later.

Examples

Example 1

This configuration will create an Active Directory domain fine-grained password policy with default settings.

Configuration ADFineGrainedPasswordPolicy_ConfigurePolicyWithDefaults_Config
{
    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADFineGrainedPasswordPolicy 'FineGrainedPasswordPolicy'
        {
            Name       = 'DomainUsers'
            Precedence = 10
        }
    }
}

Example 2

This configuration will create an Active Directory domain fine-grained password policy with specific settings.

Configuration ADFineGrainedPasswordPolicy_ConfigurePolicyWithSpecifics_Config
{
    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADFineGrainedPasswordPolicy 'FineGrainedPasswordPolicy'
        {
            Name                            = 'DomainAdmins'
            DisplayName                     = 'Domain Admins Password Policy'
            Description                     = 'This is the Fine Grained Password Policy for Domain Admins'
            Subjects                        = 'Domain Admins'
            ComplexityEnabled               = $true
            LockoutDuration                 = '00:30:00'
            LockoutObservationWindow        = '00:30:00'
            LockoutThreshold                = 5
            MaxPasswordAge                  = '42.00:00:00'
            MinPasswordAge                  = '1.00:00:00'
            MinPasswordLength               = 15
            PasswordHistoryCount            = 24
            ReversibleEncryptionEnabled     = $false
            ProtectedFromAccidentalDeletion = $true
            Precedence                      = 10
        }
    }
}

Example 3

This configuration will remove an Active Directory domain fine-grained password policy.

Configuration ADFineGrainedPasswordPolicy_RemovePolicy_Config
{
    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADFineGrainedPasswordPolicy 'FineGrainedPasswordPolicy'
        {
            Name       = 'DomainUsers'
            Precedence = 10
            Ensure     = 'Absent'
        }
    }
}