Trying to determine if there's a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp pwds for a group w/ a 10-day expiry FGPP, but only have that FGPP in place until the pwds expire in 10 days, or they change their pwds (then revert to the domain "Max-Pwd-Age" etc. policy).

1 Answer 1


FGPP provides password policies, but does not to my understanding provide a means of applying to groups, OU's, etc. only for a defined period of time.

That said, I am curious why a group would have a temporarily shorter (assuming your domain setting is longer than 10 days :) )password age?

It seems to me the only way to accomplish this would be to apply a FGPP to an OU, then use an AD-automating method to periodically test the accounts' last password change value and move it to another OU based on that. I am not an AD "expert" but I am aware of tools that may make doing so possible.

  • Thx Sean, yeah I'm not seeing many ways to handle this. Was thinking scheduled task also. seems to be the only way to handle this, but thx for confirming. FYI by "group", I meant a group of users to which FGPPs would be applied individually. We have an app upgrade req to temporarily change users' pwds en masse to get some stuff to work post-upgrade, but those pwds must return to being "interactive" (user-driven/responsible,) soon after.
    – galaxis
    Sep 18, 2019 at 17:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .