Windows 2000 Fine-Grained Password Policies

Microsoft Windows 2000 does not natively support fine-grained password policies; instead, it enforces a single, domain-wide password policy applied at the domain root. While modern Windows Server versions use Password Settings Objects (PSOs) to assign different password requirements to specific users or groups, Windows 2000 administrators had to rely on architectural workarounds, such as multi-domain forests or custom password filter DLLs, to simulate granular complexity rules across different user segments.

The Single Policy Architecture of Windows 2000

In Windows 2000 Active Directory, password policies are defined within Group Policy Objects (GPOs), specifically under Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy. However, Active Directory accounts only inherit password settings from a GPO linked to the root of the domain—typically the Default Domain Policy.

Although administrators could link GPOs with different password settings to specific Organizational Units (OUs), these OU-level policies did not apply to domain accounts. Instead, they only applied to the local Security Accounts Manager (SAM) databases of member servers and workstations residing in those OUs. Consequently, a single domain could enforce only one set of domain account password rules.

Native Password Complexity Rules

For the domain as a whole, Windows 2000 enforces complexity using the built-in passfilt.dll mechanism. When the "Passwords must meet complexity requirements" setting is enabled, passwords must:

  • Not contain the user's account name or portions of the user's full name.
  • Be at least six characters long (or the minimum length configured in the policy).
  • Contain characters from at least three of the following four categories:
    • English uppercase letters (A–Z)
    • English lowercase letters (a–z)
    • Base 10 digits (0–9)
    • Non-alphanumeric characters (e.g., !, $, #, %)

Workarounds to Achieve Granular Enforcement

Because Windows 2000 lacks native fine-grained policies, organizations requiring varied password policies had to use specific workarounds:

  • Multiple Domains: Organizations created separate child domains within an Active Directory forest. Administrators who required strict policies for privileged accounts (such as administrators) placed those accounts in a dedicated administrative domain with a higher complexity threshold, while standard users remained in a domain with standard policies.
  • Custom Password Filters: Administrators developed or purchased custom notification packages and password filter DLLs registered under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages on all Domain Controllers. When a user attempted a password reset, the custom filter evaluated the user's group membership in Active Directory and programmatically applied custom complexity rules before accepting or rejecting the change.
  • Third-Party Identity Management Software: Third-party tools intercepted password changes at the web or client level, checking user attributes or OU locations against custom rule sets before submitting the update to Active Directory.

Native support for distinct password policies within a single domain was not introduced until Windows Server 2008, which implemented Fine-Grained Password Policies using Password Settings Objects.