Unable to set blank password for win2k3 domain client - RSoP - GPO

[Jay Bollyn]

I have a GPO in effect for client PC25a. When I run RSoP as PC25a, I get the following:

http://orion.neiu.edu/~jbollyn/mcsa/rsop.jpg

RSoP clearly shows a password of 0 length is allowed, and password history is not enforced. Yet when I try to set a blank password from PC25a's desktop, I get the following dialog:

+++++++++++++++++++++++

Change Password

Your password must be at least 1 characters, cannot repeat any of your previous 24 passwords and must be at least 1 days old. Please type a different password. Type a password which meets these requirements in both text boxes. (OK)

+++++++++++++++++++++++

All the other GPO settings work fine. I have rebooted, powered off, gpupdate.exe, etc. Did not help.

Any ideas?

:-) Jay

[Jay Bollyn]

I should have mentioned that PC25a is running winxp SP2.

[Jay Bollyn]

Solved.

I had to run gpedit.msc on the server console. I set the Password Policy settings to 0,0,0,0,disabled,disabled. Blank passwords are now allowed.

I did not realize that running gpedit.msc on the server console would have this effect on GPOs. I would at least expect that if this behavior is by design (and not a bug), that running RSoP on the client would show the actual policy settings in effect.

I will keep this open briefly, for any comments.

[Norman_21 · Accepted solution]

Jay,

This is by design.
GPEDIT.MSC at the Server is the default GPO of the Domain Controller [Under AD U&C ->DC Name]

However, if you don't want a GPO that is applied at the OU level to inheret the default GPO settings of the DC. At the GPO properties of the OU, select the No Override Option and run gpupdate.exe

Hope this help

[Jay Bollyn]

Thanks, Latif.