Skip to content
MitoMito Docs

AD-FGPP-03: Fine-grained password policy setting counts should be retrievable
ID AD-FGPP-03
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Password policy
Security area Authentication
Resource type Policy
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Having a detailed breakdown of fine-grained password policy settings allows you to:

  • Audit security levels: Verify that privileged accounts have stronger policies
  • Identify misconfigurations: Spot policies that may be incorrectly configured
  • Ensure compliance: Validate that all policies meet minimum security requirements
  • Document coverage: Understand exactly what controls are in place

This detailed view complements the value count by showing the actual settings rather than just the number of variations.

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

When reviewing fine-grained password policy settings, ensure:

User Type Min Length Max Age History Complexity Lockout Threshold
Domain Admins 15+ 60 days 24+ Enabled 3-5
Service Accounts 20+ Never 24+ Enabled 3-5
Regular Users 14+ 90 days 24 Enabled 5

To review and modify policy settings:

  1. Open Active Directory Administrative Center
  2. Navigate to System > Password Settings Container
  3. Double-click each policy to review settings
  4. Adjust as needed to meet security requirements

How the Test Works

Section titled “How the Test Works”

This test retrieves all fine-grained password policies using Get-ADFineGrainedPasswordPolicy and creates a table showing key settings for each policy:

  • Policy name
  • Minimum password length
  • Maximum password age (in days)
  • Password history count
  • Complexity enabled (Yes/No)
  • Lockout threshold
Section titled “Related Tests”
  • Test-MtAdFineGrainedPolicyCount - Counts the number of FGPPs
  • Test-MtAdFineGrainedPolicyValueCount - Shows distinct values across policies
  • Test-MtAdFineGrainedPolicyAppliesTo - Shows which users/groups each policy applies to

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.