Password Policy Manager is deployed on all Domain Controllers (DC) via the Group Policy. You can create a new Group Policy Object (GPO) or use an existing one to assign the Password Policy Manager installation package to the destination computers. Password Policy Manager is then installed on computers on which the GPO applies.
The installation package is located in the \Password Manager\Setup folder of the ISO image or the extracted installation archive, and has the following file name:
PasswordPolicyManager_x64.msi
To configure rules for a password policy:
- On the home page of the Administration site, click the Password Policies tab
- Under the Password Policies for Managed Domains tab, click Add domain connection
- If you already have a Domain Connection configured (such as for User and Helpdesk scopes), click Use this connection
- Click One Identity password policies are not configured
- Click Add new password policy
- Enter an appropriate policy name when prompted
- Click Edit and configure the required settings under the Policy Rules tab
- Click Policy Scope tab
- Click Add in both the Organizational Units and Groups options to link the Policy to the appropriate Organizational Unit and corresponding Group.
|
|
NOTE: You must select both or the policy will not be applied to users. The options set here are exactly as you would see the Link option in the native Microsoft Group Policy Management Console (GPMC.msc) MMC Snap-In. |
- Once the Policy Rules are configured and the Policy is linked, click the Policy Settings tab and un-check the Disable this policy feature to enable the policy
- Click Save
The following are the common configuration recommendations:
- Use the same Domain Connection for User Scope, Helpdesk Scope and Password Policy settings.
Example:
Figure 8:
- When adding in a User Scope, choose Use this connection if you already have a connection to that Domain.
Example:
Figure 9:
Figure 10:
Why?
The duplicate entries increase the size of the Shared.storage file, which in turn gets replicated to Active Directory, which will increase network traffic with a larger replicated data size. The duplicate entries also cause numerous duplicate connections with the Scheduled Tasks and thus increases the time it takes to complete each Scheduled Task.
For example, if you have a total of 20 Management Scopes, you should only have 20 Domain Connections. If you were to select Add domain connection for every User Scope, Helpdesk Scope and Password Policy setting you would have 60 total Domain Connections.
