Windows 2000 Password Policy in Child Domains

In Microsoft Windows 2000 Active Directory, password policies do not inherit from parent domains to child domains. Because the domain acts as the definitive security boundary, account and password policies are enforced strictly on a per-domain basis. This article explains how Windows 2000 isolates password policies across domain trees, how each domain enforces its own rules, and the methods administrators used to maintain consistent standards throughout a forest.

The Domain as a Security Boundary

In Windows 2000, Active Directory treats each domain as an isolated security authority. Account policies—which include password history, maximum and minimum password age, minimum password length, complexity requirements, and account lockout thresholds—are read exclusively by the domain controllers of the specific domain holding those accounts. Consequently, Group Policy inheritance terminates at the domain boundary for these settings; settings applied at the root of a parent domain do not automatically flow down to any subordinate child domains.

How Windows 2000 Enforces Password Policies

Windows 2000 utilizes the Local Security Authority (LSA) and Kerberos key distribution centers (KDC) running on domain controllers to evaluate password rules. For these settings to apply to domain user accounts:

  • Root Domain Linking: The password policy must be linked to the root of the specific domain, typically via the Default Domain Policy Group Policy Object (GPO).
  • Single Policy Limitation: Windows 2000 supports only one password policy per domain. Defining password policies in GPOs linked to Organizational Units (OUs) has no effect on domain user accounts; OU-level policies apply only to local accounts on member servers or workstations within that OU.
  • Child Domain Autonomy: When a child domain is created, Active Directory automatically creates a separate Default Domain Policy GPO for that child domain. The child domain immediately applies its own default settings, completely independent of whatever modifications were made in the parent domain.

Managing Consistency Across Parent and Child Domains

Because automatic inheritance across domains is not supported by design, administrators who required uniform password requirements across an entire Windows 2000 forest had to manage them manually or through automation:

  1. Manual Configuration: Administrators manually configured the Default Domain Policy GPO in each child domain to mirror the settings defined in the parent domain.
  2. Security Template Deployment: Administrators created a centralized Security Template (.inf file) containing the desired forest-wide password rules and imported it into the Default Domain Policy of each parent and child domain using the Security Configuration and Analysis snap-in.
  3. Scripted GPO Management: Administrative scripts using tools such as secedit.exe were used to apply the standardized security templates programmatically during or after child domain promotion.