Was this page helpful?
Your feedback about this content is important. Let us know what you think.
Additional feedback?
1500 characters remaining
Export (0) Print
Expand All
Expand Minimize

3.1.1.4.5.36 msDS-ResultantPSO

The msDS-ResultantPSO attribute exists on AD DS beginning with Windows Server 2008 operating system. This attribute does not exist on AD LDS. This attribute specifies the effective password policy applied on this object.

The value of msDS-ResultantPSO is a single value of Object (DS-DN) syntax. This attribute is constructed as follows:

Let RESULTSET be a set of DS-DN, initially empty.

Let U be the object from which the msDS-ResultantPSO attribute is being read.

  • If the domain functional level is less than DS_BEHAVIOR_WIN2008, then there is no value in this attribute.

  • If U!objectClass does not contain the value "user", then there is no value in this attribute.

  • If the bit for ADS_UF_NORMAL_ACCOUNT (see section 2.2.16) is not set in U!userAccountControl, then there is no value in this attribute.

  • If the RID in U!objectSid is equal to DOMAIN_USER_RID_KRBTGT, then there is no value in this attribute.

  • If the U!msDS-SecondaryKrbTgtNumber attribute has a value, then there is no value in this attribute.

  • Let RESULTSET be the values of U!msDS-PSOApplied that are of object class msDS-PasswordSettings and are under the Password Settings container (see section 6.1.1.4.11.1)

  • If RESULTSET is empty:

    • Let S be the set of objects returned by invoking the algorithm in [MS-DRSR] section 4.1.8.3 (IDL_DRSGetMemberships) using DRS_MSG_REVMEMB_REQ_V1.OperationType=RevMembGetAccountGroups, DRS_MSG_REVMEMB_REQ_V1.ppDsNames=U, and DRS_MSG_REVMEMB_REQ_V1.pLimitingDomain = the domain for which the server is a DC.

    • For each O (an object) in S do the following:

      • RESULTSET = RESULTSET union O!msDS-PSOApplied

  • Sort objects in set RESULTSET according to msDS-PasswordSettingsPrecedence values, breaking ties with objectGUID values, with smaller values coming first.

  • Return the first element in the sorted RESULTSET (if empty, the msDS-ResultantPSO attribute is not present).

Show:
© 2015 Microsoft