Q. How can I enable complex passwords on my Windows Server 2003 Active Directory (AD) domain?

Open the Group Policy Object (GPO) that's linked at the domain level. For example, open the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in, right-click the domain, select Properties, select the Group Policy tab, select the GPO, then click Edit. Doing so opens Group Policy Editor (GPE). Remember that password policies are part of the Account Settings group and take effect only when you set them at domain level; they won't be implemented if you set them at site or organizational unit (OU) levels.

Select Computer Configuration, Windows Settings, Security Settings, Account Policies, Password Policy.

Double-click the relevant settings and set them to the settings you want (e.g., Password must meet complexity requirements," "Minimum password length," "Maximum password age"). The figure shows the default settings for a new Windows 2003 domain, which are a good baseline.

Close GPE.