Exchange Server 2019 -- HealthMailbox -- Change password and apply AD Password Policy

Hi @SenhorDolas,

Thanks for your response.

Yes, you can reset passwords based on security policy recommendations and can apply AD password policies to expire passwords within 365 days. I suggest you try the following steps:

Reset Password

1. Reset passwords via Active Directory Users and Computers (ADUC):

• Open the ADUC management console.
• Find the required user account (in your current domain).
• Right-click the user account and select "Reset Password".
• Enter a new password and confirm it (make sure it meets your security policy requirements, such as 30 characters).

2. Batch reset passwords via PowerShell:

If you have multiple accounts to reset, you can use a PowerShell script to do the bulk operation. Here is a sample script:

Import-Module ActiveDirectory

$users = Get-ADUser -Filter * -SearchBase "OU=YourOU,DC=YourDomain,DC=com"

foreach ($user in $users) {

$newPassword = "YourComplexPassword123!" # You can generate a more complex password

Set-ADAccountPassword -Identity $user -Reset -NewPassword (ConvertTo-SecureString -AsPlainText $newPassword -Force)

}

Apply AD Password Policy

1. Set Password Policy:

You can configure password policy through the Group Policy Management Console (GPMC).

• Open GPMC and find the appropriate Group Policy Object (GPO).
• Edit the GPO and navigate to Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy.
• Set the "Maximum Password Age" to 365 days.
• Ensure that other policies also meet your security requirements, such as password length and complexity.

2. Through Fine-Grained Password Policies (FGPP):

Fine-grained password policies allow you to apply a different password policy than the default domain policy to specific users or groups.

New-ADFineGrainedPasswordPolicy -Name "365DaysPasswordPolicy" `

-ComplexityEnabled $true `

-LockoutDuration "00:30:00" `

-LockoutObservationWindow "00:30:00" `

-LockoutThreshold 5 `

-MaxPasswordAge "365.00:00:00" `

-MinPasswordAge "1:00:00" `

-MinPasswordLength 30 `

-PasswordHistoryCount 24 `

-Precedence 1 ```

Then apply this policy to specific users or groups:

```powershell

Add-ADFineGrainedPasswordPolicySubject -Identity "365DaysPasswordPolicy" -Subjects "CN=YourUser,DC=YourDomain,DC=com"

Be sure to back up your current configuration before changing passwords and policies, and test these changes in a test environment to avoid unnecessary impact on your production environment.

Please feel free to contact me if you have any queries.

Best,

Jake Zhang

Hi @SenhorDolas,

If the answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A! 

Best,

Jake Zhang