Fine Grained Password policy not reflected in ADUC

Question

I have created a fine grained password policy in Adaxes with expiry dates in 100 days. It appears to work. However ADUC still show the accounts expirying in 42 days as dictated by default domain policy.

Should ADUC reflect the policy as enforced by Adaxes or only reflect the domain policy even if it no longer applies to the user?

Answer 1

Hello,

As far as we know, by default, in ADUC, you cannot view when a user's password is to expire. This is possible only using add-ins to ADUC, such as the Additional Account Info tab or similar. If this is the case, probably the add-in to ADUC is not working properly.

Comments

You are right I am using the the addional inof tab which may not be supported.

So ok, how do i see the password expiry date in Adaxes? I want to prove the fine grained password policy worked.

---

One additional thing. I have a scheduled task that notifies users when their pw will expiry. However that Adaxes tool seem to look at the domain policy and not the Fine Grained policy.

---

Hello,

So ok, how do i see the password expiry date in Adaxes? I want to prove the fine grained password policy worked.

Take a look at step 6 of the Manage Fine-Grained Password Policies Tutorial.

One additional thing. I have a scheduled task that notifies users when their pw will expiry. However that Adaxes tool seem to look at the domain policy and not the Fine Grained policy.

The Password Expiration Notifier builtin Scheduled Task takes Fine-Grained Policies into account. We have re-tested this in our testing environment today, and everything works OK.
If this does not work as desired in your environment, then we need to have a closer look at your Password Policies.

---

Yes it seems to be OK , thank-you for your help.