Domain Policies¶
Password, lockout, and Kerberos policy for every domain account come from one place: gpmc.msc → Forest → Domains → your domain → Default Domain Policy → right-click → Edit → Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies. Setting them in secpol.msc on the DC does nothing for domain accounts.
Password and lockout¶
The values are the ones on the Password Policy and Lockout Policy pages, with the same CIS numbers (1.1.x and 1.2.x), set in the Default Domain Policy instead of secpol. Two items are new in the domain benchmark:
| CIS | Setting | Value | Profile | Why |
|---|---|---|---|---|
| 1.1.6 | Relax minimum password length limits | Enabled | Member Server | Lets the minimum password length go above 14. Without it, the "14 or more" recommendation caps at 14. |
| 1.2.3 | Allow Administrator account lockout | Enabled | Member Server | The built-in Administrator locks out like everyone else instead of being a guaranteed password-guessing target |
Read the effective policy back from any domain machine:
net accounts /domain
PowerShell shows the same thing plus where it came from:
Get-ADDefaultDomainPasswordPolicy
Fine-grained password policies¶
A domain can have Password Settings Objects (PSOs) that override the Default Domain Policy for a group. An image can hide a weak one that applies to the administrators:
Get-ADFineGrainedPasswordPolicy -Filter * | Select Name, Precedence, MinPasswordLength, LockoutThreshold, AppliesTo
Anything the README doesn't describe, and anything weaker than the domain policy, gets removed: Remove-ADFineGrainedPasswordPolicy <name>.
Kerberos policy¶
Kerberos is how a domain authenticates. Its tickets have lifetimes, and the lifetimes are the window in which a stolen ticket works. Same GPO, Account Policies → Kerberos Policy. These are STIG items (WN22-DC-000020 to 000060); the CIS benchmark leaves them at the defaults, which already meet them.
| Setting | Value | Why |
|---|---|---|
| Enforce user logon restrictions | Enabled | The DC checks the user still has the right to log on before issuing a service ticket, so a disabled account can't keep using old tickets |
| Maximum lifetime for service ticket | 600 minutes (10 hours), not 0 | 0 means tickets never expire |
| Maximum lifetime for user ticket | 10 hours, not 0 | The ticket-granting ticket; a stolen one is good for this long |
| Maximum lifetime for user ticket renewal | 7 days | How long a ticket can be renewed before the user must re-authenticate |
| Maximum tolerance for computer clock synchronization | 5 minutes | Kerberos rejects tickets timestamped outside this window, which blocks replay; a larger window means older captures work |
Those are the Windows defaults. An image that changed them made them larger; check with gpresult /h or open the policy and look.
Apply and verify¶
gpupdate /force
net accounts /domain
net accounts /domain reflects the Default Domain Policy within a minute of the update. If it doesn't, another GPO linked at the domain level with higher precedence is setting the same values; gpmc.msc → the domain → Linked Group Policy Objects shows the order.
Example¶
net accounts /domain shows Minimum password length 0 and Lockout threshold Never. Open the Default Domain Policy: the values are 12 and 5, correct. But a second GPO called "Legacy Compatibility" is linked above it at the domain level with length 0 and no lockout. The README doesn't mention it. Unlink it (right-click → Link Enabled off), gpupdate /force, and re-check.