From 8718b39f6367c7376c06327d7b06ed8f6ce30b15 Mon Sep 17 00:00:00 2001 From: Cliff Fisher <90731351+BRDPM@users.noreply.github.com> Date: Fri, 20 Sep 2024 08:37:16 -0700 Subject: [PATCH] Update New-ADFineGrainedPasswordPolicy.md (#3818) * Update New-ADFineGrainedPasswordPolicy.md Removing example 3, which is completely incorrect, and adding a disclaimer to Lockout Observation Window. * Update docset/winserver2022-ps/activedirectory/New-ADFineGrainedPasswordPolicy.md Adding suggested review changes Co-authored-by: Sean Wheeler --------- Co-authored-by: Sean Wheeler --- .../New-ADFineGrainedPasswordPolicy.md | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/docset/winserver2022-ps/activedirectory/New-ADFineGrainedPasswordPolicy.md b/docset/winserver2022-ps/activedirectory/New-ADFineGrainedPasswordPolicy.md index 6517995ce1..6ccea5fdbf 100644 --- a/docset/winserver2022-ps/activedirectory/New-ADFineGrainedPasswordPolicy.md +++ b/docset/winserver2022-ps/activedirectory/New-ADFineGrainedPasswordPolicy.md @@ -71,13 +71,6 @@ PS C:\> New-ADFineGrainedPasswordPolicy -Instance $TemplatePSO -Name "AdminsPSO" This example creates two new fine-grained password policy objects using a template object. -### Example 3: Create a fine-grained password policy with manual account unlock -```powershell -PS C:\> New-ADFineGrainedPasswordPolicy -Name "ManualUnlockPSO" -Precedence 500 -ComplexityEnabled $true -Description "Manual Unlock Password Policy" -DisplayName "Manual Unlock PSO" -LockoutDuration "00:00:00" -LockoutObservationWindow "00:00:00" -LockoutThreshold 3 -``` - -This command creates a fine-grained password policy object named ManualUnlockPSO that would require manual unlock of accounts by the administrator. - ## PARAMETERS ### -AuthType @@ -275,6 +268,10 @@ The LDAP display name (**ldapDisplayName**) of this property is **msDS-lockoutOb The lockout observation window must be smaller than or equal to the lockout duration for a password policy. Use the *LockoutDuration* parameter to set the lockout duration time. +> [!NOTE] +> Setting the lockout observation window to 0 effectively means that the window is too short to +> observe more than one password attempt, therefore the account will never be locked out. + Specify the time interval in the following format: `D:H:M:S.F`