DSCResources/MSFT_ADFineGrainedPasswordPolicy/en-US/about_ADFineGrainedPasswordPolicy.help.txt

.NAME
    ADFineGrainedPasswordPolicy
 
.DESCRIPTION
    The ADFineGrainedPasswordPolicy DSC resource will manage an Active Directory domain's fine grained password policies.
 
    ## Requirements
 
    * Target machine must be running Windows Server 2012 or later.
 
.PARAMETER Name
    Key - String
    Specifies an Active Directory fine-grained password policy object name.
 
.PARAMETER Precedence
    Required - UInt32
    Specifies a value that defines the precedence of a fine-grained password policy among all fine-grained password policies.
 
.PARAMETER DisplayName
    Write - String
    Specifies the display name of the object.
 
.PARAMETER Description
    Write - String
    Specifies the description of the object.
 
.PARAMETER Subjects
    Write - StringArray
    Specifies the ADPrincipal names the policy is to be applied to, overwrites all existing.
 
.PARAMETER Ensure
    Write - String
    Allowed values: Present, Absent
    Specifies whether the fine-grained password policy should be present or absent. Default value is 'Present'.
 
.PARAMETER ComplexityEnabled
    Write - Boolean
    Specifies whether password complexity is enabled for the password policy.
 
.PARAMETER LockoutDuration
    Write - String
    Specifies the length of time that an account is locked after the number of failed login attempts exceeds the lockout threshold. The lockout duration must be greater than or equal to the lockout observation time for a password policy. The value must be a string representation of a TimeSpan value.
 
.PARAMETER LockoutObservationWindow
    Write - String
    Specifies the maximum time interval between two unsuccessful login attempts before the number of unsuccessful login attempts is reset to 0. The lockout observation window must be smaller than or equal to the lockout duration for a password policy. The value must be a string representation of a TimeSpan value.
 
.PARAMETER LockoutThreshold
    Write - UInt32
    Specifies the number of unsuccessful login attempts that are permitted before an account is locked out.
 
.PARAMETER MinPasswordAge
    Write - String
    Specifies the minimum length of time before you can change a password. The value must be a string representation of a TimeSpan value.
 
.PARAMETER MaxPasswordAge
    Write - String
    Specifies the maximum length of time that you can have the same password. The value must be a string representation of a TimeSpan value.
 
.PARAMETER MinPasswordLength
    Write - UInt32
    Specifies the minimum number of characters that a password must contain.
 
.PARAMETER PasswordHistoryCount
    Write - UInt32
    Specifies the number of previous passwords to save.
 
.PARAMETER ReversibleEncryptionEnabled
    Write - Boolean
    Specifies whether the directory must store passwords using reversible encryption.
 
.PARAMETER ProtectedFromAccidentalDeletion
    Write - Boolean
    Specifies whether to prevent the object from being deleted.
 
.PARAMETER DomainController
    Write - String
    Specifies the Active Directory Domain Services instance to connect to.
 
.PARAMETER Credential
    Write - Instance
    Specifies the user account credentials to use to perform this task.
 
.EXAMPLE 1
 
This configuration will create an Active Directory domain fine-grained password
policy with default settings.
 
Configuration ADFineGrainedPasswordPolicy_ConfigurePolicyWithDefaults_Config
{
    Import-DscResource -Module ActiveDirectoryDsc
 
    Node localhost
    {
        ADFineGrainedPasswordPolicy 'FineGrainedPasswordPolicy'
        {
            Name = 'DomainUsers'
            Precedence = 10
        }
    }
}
 
.EXAMPLE 2
 
This configuration will create an Active Directory domain fine-grained password
policy with specific settings.
 
Configuration ADFineGrainedPasswordPolicy_ConfigurePolicyWithSpecifics_Config
{
    Import-DscResource -Module ActiveDirectoryDsc
 
    Node localhost
    {
        ADFineGrainedPasswordPolicy 'FineGrainedPasswordPolicy'
        {
            Name = 'DomainAdmins'
            DisplayName = 'Domain Admins Password Policy'
            Description = 'This is the Fine Grained Password Policy for Domain Admins'
            Subjects = 'Domain Admins'
            ComplexityEnabled = $true
            LockoutDuration = '00:30:00'
            LockoutObservationWindow = '00:30:00'
            LockoutThreshold = 5
            MaxPasswordAge = '42.00:00:00'
            MinPasswordAge = '1.00:00:00'
            MinPasswordLength = 15
            PasswordHistoryCount = 24
            ReversibleEncryptionEnabled = $false
            ProtectedFromAccidentalDeletion = $true
            Precedence = 10
        }
    }
}
 
.EXAMPLE 3
 
This configuration will remove an Active Directory domain fine-grained password policy.
 
Configuration ADFineGrainedPasswordPolicy_RemovePolicy_Config
{
    Import-DscResource -Module ActiveDirectoryDsc
 
    Node localhost
    {
        ADFineGrainedPasswordPolicy 'FineGrainedPasswordPolicy'
        {
            Name = 'DomainUsers'
            Precedence = 10
            Ensure = 'Absent'
        }
    }
}