What is the effective minimum password length for User1 and Admin1? To answer, select the appropriate options in the answer area.

Question

Explanation

This question tests understanding of Fine-Grained Password Policies (FGPPs) in Active Directory and how the 'effective' minimum password length is determined when multiple policies (Default Domain Policy and Password Settings Objects) apply to different users.

Approach. In Windows Active Directory, the Default Domain Policy sets a baseline minimum password length for all domain users. Fine-Grained Password Policies (Password Settings Objects / PSOs) can override this baseline for specific users or groups - PSOs always take precedence over the Default Domain Policy. For a standard user like User1 with no PSO applied, the effective minimum password length is whatever the Default Domain Policy specifies (commonly 8 characters). For a privileged account like Admin1 that has a PSO applied (e.g., requiring 12 or 14 characters), the PSO value is the effective minimum - you read the 'Minimum Password Length' attribute directly from the PSO, not the domain policy. If multiple PSOs apply to the same user, the one with the lowest Precedence number wins.

Concept tested. Fine-Grained Password Policies (FGPPs) / Password Settings Objects (PSOs) in Active Directory - specifically how effective password policy is resolved when a Default Domain Policy and one or more PSOs coexist, and which policy wins for a given user account (regular vs. privileged).

Reference. Microsoft Docs: Fine-Grained Password Policies (AD DS) - PSOs take precedence over the Default Domain Policy; CompTIA Security+ SY0-701 Objective 4.6 (Identity and Access Management) and Microsoft SC-300 / AZ-800 exam domains.

No community discussion yet for this question.