password change policy question

[chicagotech]

One of our clients starts to process their password change policy that will need to be changed every 60 days. Here i sthe client question. If I change my password now, will I need to change it on July 2th?

If a user changes his password today (6/10/2010) and we enable password policy on July 2th, does the policy will force the user change his password on July 2th?

[chicagotech]

normally, the policy can’t force the user to change his password.


Because from 6/10/2010 to on 7/2/2010, the duration time is only 22 days, even add the time that prompt user to change password in advance(14 days), it’s only 38 days, not up to 60 days, so the policy can’t force the user to change the password.



As far as I know, the theory of the Password Expiration policy is: every user object has a PwdLastSet attribute, when a user change it’s password, the attribute will record the timestamp, the policy use this attribute value to judge if the password will be expired in 60 days(your time setting).In addition, please noticed that the password expiration policy only be configured on Domain-level, not configured on OU(doesn’t take effect).



Reference Articles
===========================

Apply or modify password policy

http://technet.microsoft.com/en-us/library/cc781633(WS.10).aspx



Interactive logon: Prompt user to change password before expiration

http://technet.microsoft.com/en-us/library/cc783344(WS.10).aspx