This page explains the fine-grained password policies (FGPP) concepts and
related best practices for Managed Service for Microsoft Active Directory.

## Overview

You can use
[FGPP](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc770394(v=ws.10))
to define and enforce strong password settings on a specific Active Directory
user or group. Note that password policies are different from the default domain
password policy which is configured by a group policy and linked to the root of
the domain.

FGPP is set in Password Settings Objects (PSO). Each PSO has a precedence
value that indicates its priority. The lower this value, the higher the priority
of that PSO. Managed Microsoft AD creates ten PSOs with default settings. You
cannot change the names or precedences of these PSOs, but you can change the
settings. For more information about the pre-created PSOs, see [Password
Settings Objects](https://docs.cloud.google.com/managed-microsoft-ad/docs/objects#password_settings_objects).

### Policy settings

Each PSO can contain the following policy settings:

- [Complexity enabled](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements)

- [Lockout duration](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/hh994569(v=ws.10))

- [Lockout observation window](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/hh994568(v=ws.10))

- [Lockout threshold](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/hh994574(v=ws.10))

- [Maximum password age](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/hh994573(v=ws.10))

- [Minimum password length](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/hh994560(v=ws.10))

- [Password history count](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/enforce-password-history)

- [Reversible encryption enabled](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/hh994559(v=ws.10))

## What's next

- [Configure fine-grained password policies](https://docs.cloud.google.com/managed-microsoft-ad/docs/how-to-use-fgpp.md.txt)