Active Directory | Understanding Password Policy vs Group Policy (GPO) Password Settings

Overview 💥

Partners may notice that password policy values displayed in the Active Directory Inspector differ from what is configured in Group Policy (GPO).

Example:

Location Checked	Maximum Password Age
Liongard Active Directory Inspector	Not Configured (0)
Group Policy Management	90 Days

This often leads to concerns that:

❌ Liongard inspection data is incorrect

In reality:

✅ Liongard is accurately reporting Active Directory domain password policy.
✅ The comparison is being made against a different policy enforcement layer.

Understanding where password policies actually live in Windows environments resolves this confusion.

The Core Concept 🔑

Windows password enforcement operates across multiple independent layers.

Liongard reports each layer separately — it does not merge policies.

Password Policy Architecture

               ┌───────────────────────────┐
               │   Active Directory Domain │
               │  Default Domain Policy    │
               │  (Authoritative Source)   │
               └─────────────┬─────────────┘
                             │
                             │ Replicated via AD
                             ▼
        ┌──────────────────────────────────────┐
        │ Group Policy Objects (GPO)           │
        │ - Default Domain Policy              │
        │ - OU Policies                        │
        │ - Server Policies                    │
        └─────────────┬────────────────────────┘
                      │
                      ▼
        ┌──────────────────────────────────────┐
        │ Windows Servers / Workstations       │
        │ Effective Local Security Policy      │
        └──────────────────────────────────────┘

What Each Liongard Inspector Reports 📊

Inspector	Reports	Policy Scope
Active Directory Inspector	Domain password policy	AD Domain Level
Windows Server Inspector	Effective applied policy	Server Level
GPO Reports Dataset	Configured GPO settings	Policy Configuration

All are correct — they simply answer different questions.

What the Active Directory Inspector Shows 🖥️

The Active Directory Inspector retrieves the Default Domain Password Policy stored directly in Active Directory.

This includes:

Maximum Password Age
Minimum Password Length
Password History
Complexity Requirement
Lockout Settings

Think of this as "The official domain-wide rulebook". If no domain policy exists, Liongard correctly reports:

Not Configured

or default AD values.

Why GPO Shows Different Password Settings 🤔

Administrators commonly configure password settings inside:

Group Policy Management Console (GPMC)

Example:

Maximum Password Age = 90 days

However:

⚠️ Not every GPO password setting becomes the domain password policy.

Password settings only become authoritative when:

✅ Configured in Default Domain Policy
✅ Linked at the domain root

Policies applied to:

Organizational Units (OU)
Servers
Test environments
Local policies

may appear active — but do not modify the AD domain password policy.

Why Values Differ 🧐

Example Environment:

Active Directory Domain Policy
    Maximum Password Age → Not Configured

OU-Level GPO
    Maximum Password Age → 90 Days

Result:

Location	Value Seen
Active Directory Inspector	Not Configured (0)
Windows Server Inspector	90 Days
GPO Editor	90 Days

✅ No data mismatch exists.

Different enforcement scopes are being viewed.

Where GPO Password Policies Exist in Liongard 🔍

Liongard captures GPO policy data separately under:

GPOReport.GPOS.GPO[].Computer.ExtensionData[].Extension."q1:Account"

Example Metric Query:

GPOReport.GPOS.GPO[].Computer.ExtensionData[].Extension."q1:Account"
[? "q1:Name" == 'MaximumPasswordAge']

This shows:

✅ Policies defined inside GPO
✅ Intended configuration
✅ Policy design — not domain authority

Why Windows Server Inspector Often Matches GPO 🧑‍🏫

Servers apply policies differently. The Windows Server Inspector evaluates:

Effective Policy Applied To The Server

Meaning it reflects:

✔ GPO inheritance
✔ Local security policy
✔ Applied enforcement result

So it commonly matches what administrators expect from GPO.

Real Enforcement Flow (Important)

GPO Configured
        ↓
Applied to Server
        ↓
Server Enforces Policy
        ↓
Active Directory Domain Policy
(May remain unchanged)

Liongard exposes both viewpoints.

PowerShell Validation Commands 🖥️

Verify Password Policies Directly in Active Directory

If there is uncertainty about password policy values shown in the Active Directory Inspector, administrators can validate the configuration directly from Active Directory using PowerShell.

These commands help confirm exactly what Active Directory and Group Policy are enforcing.

1️⃣ Check Default Domain Password Policy (Authoritative Source)

Run the following command on a Domain Controller or from a system with RSAT installed:

Get-ADDefaultDomainPasswordPolicy

Example Output

MaxPasswordAge           : 42.00:00:00
MinPasswordLength        : 8
PasswordHistoryCount     : 24
ComplexityEnabled        : True
LockoutThreshold         : 5

✅ This command shows:

The true domain password policy
The same values reported by the Liongard Active Directory Inspector

If this differs from GPO settings, the domain policy itself has not been modified.

2️⃣ Verify Domain Policy Using Legacy Command

You may also validate using:

net accounts

Example output:

Maximum password age (days): 42
Minimum password length: 8
Lockout threshold: 5

✅ Reads policy directly from Active Directory.

3️⃣ Check Fine-Grained Password Policies (FGPP)

Organizations may apply password rules to specific users or groups.

To list Fine-Grained Password Policies:

Get-ADFineGrainedPasswordPolicy -Filter *

To see which users or groups receive them:

Get-ADFineGrainedPasswordPolicySubject -Identity "PolicyName"

✅ These policies may override domain defaults for targeted accounts.

4️⃣ View Password Policy Configured in Group Policy (GPO)

To confirm what is configured inside GPO:

Get-GPOReport -All -ReportType Html -Path C:\Temp\GPOReport.html

Then open:

C:\Temp\GPOReport.html

Navigate to:

Computer Configuration
 → Policies
 → Windows Settings
 → Security Settings
 → Account Policies
 → Password Policy

✅ Shows configured GPO settings, not necessarily domain authority.

5️⃣ Check Effective Password Policy Applied to a Server

Run locally on a server or workstation:

secedit /export /cfg C:\Temp\SecurityPolicy.cfg
notepad C:\Temp\SecurityPolicy.cfg

Look for:

MaximumPasswordAge
MinimumPasswordLength
PasswordComplexity

✅ Displays the effective policy applied to that machine.

This commonly matches what administrators observe via GPO.

6️⃣ Confirm Which GPO Applies to a System

To identify which policies are actually applied:

gpresult /h C:\Temp\GPResult.html

Open:

C:\Temp\GPResult.html

This shows:

Applied GPOs
Inheritance order
Winning policy source

🌟 Validation Mapping (Quick Reference)

Validation Goal	Command
Domain password policy	`Get-ADDefaultDomainPasswordPolicy`
Legacy domain verification	`net accounts`
Fine-grained policies	`Get-ADFineGrainedPasswordPolicy`
GPO configured settings	`Get-GPOReport`
Effective server policy	`secedit /export`
Applied GPOs	`gpresult /h`

✅ Expected Outcome

After running these commands:

Domain policy values should match Active Directory Inspector
Server values may match Windows Server Inspector
GPO configuration may differ depending on scope

This confirms Liongard is accurately reporting each policy layer.

Fine-Grained Password Policies (FGPP) ⚙️

Modern AD environments may use: Fine-Grained Password Policies

These apply password rules to:

Specific users
Security groups

Result:

User Group	Password Age
Standard Users	90 Days
Admin Accounts	30 Days

FGPP can cause additional expected differences.

Common Misunderstandings 👨‍🔧

Assumption	Reality
Liongard password policy is wrong	AD policy differs from GPO
GPO always equals domain policy	Only domain-root policies do
Inspectors conflict	They report different layers
Values must always match	Differences are normal

Summary 🤩

Password policy differences between Liongard and Group Policy are typically caused by comparing:

Domain-level Active Directory policy
vs
Server or OU-level Group Policy settings

Liongard accurately reports each configuration source independently to preserve visibility and prevent hidden misconfigurations.

When validating password configuration:

✅ Check Active Directory Inspector → Domain authority

✅ Check Windows Server Inspector → Effective enforcement

✅ Review GPO Reports → Configuration source

✅ Confirm via PowerShell

Microsoft Reference Documentation 📚

Microsoft confirms password policy scope behavior:

‼️ Disclaimer

This article references third-party documentation published by Microsoft for informational purposes only. External documentation is owned and maintained by the respective vendor and may change without notice. Liongard does not control or guarantee the accuracy, availability, or future behavior of third-party APIs, features, or documentation referenced herein.