Introduction
Strong Active Directory environments require more than creating users,they require deliberate security controls.
In this hands-on project, I strengthened domain security through practical Group Policy and Active Directory administration.
I configured a 14-character minimum password policy across the domain.
I then implemented a stricter 16-character fine-grained password policy specifically for Domain Admins.
This demonstrates how security requirements can be tailored according to administrative privilege levels.
I also enabled the Active Directory Recycle Bin to provide recovery capability for deleted directory objects.
These configurations reflect practical measures used to improve identity security, access control, and administrative resilience.
Together, the exercise demonstrates my ability to translate security requirements into practical Windows Server and Active Directory controls.
Overview
In this exercise, you configure group policy items related to password policies. This includes configuring the domain password policy, creating a stricter password policy for the Domain Admins group, and enabling the Active Directory Recycle Bin.
This exercise should take approximately 10 minutes to complete.
Configure Domain Password Policy
In this task, you configure the domain password policy. To complete this task, perform the following steps:
1.In TAILWIND-DC1, from the Tools menu of the Server Manager console, open the Group Policy Management console.
2.In the Group Policy Management console, expand the tailwindtraders.internal forest, the Domains folder, and the tailwindtraders.internal domain.
3.Right-click Default Domain Policy and click Edit.
4.In the Group Policy Management Editor, navigate to Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy.
5.Double click the Minimum password length policy item.
6.Change the minimum number of characters to 14.
7.Click Ok, and then close the Group Policy Management Editor window.
8.Close the Group Policy Management console.
Configure Fine-Grained Password Policy
In this task, you configure a fine-grained password policy and apply it to the Domain Admins group. To complete this task, perform the following steps in TAILWIND-DC1:
1.From the Tools menu of the Server Manager console, open Active Directory Administrative Center.
2.Under Overview, Click Tailwindtraders (local).
3.In the tailwindtraders (local) pane, open the System container.
4.In the System container, open the Password Settings Container.
5.Click the Password Settings Container, click New, and then click Password Settings.
6.In the Name field, type Domain Admin Password Policy.
7.Set the Precedence field to 1.
8.Set minimum password length to 16.
9.Click OK.
10.Open the new policy Domain Admins Password Policy.
11.In the Directly Applies to section, click Add, then type Domain Admins. Click Check Names and click OK.
12.Click OK.
Enable Active Directory Recycle Bin
In this task, you enable the Active Directory Recycle Bin. To complete this task, perform the following steps in TAILWIND-DC1:
1.From the Tools menu of the Server Manager console, open Active Directory Administrative Center.
2.Click Tailwindtraders (local) in the left pane.
3.In the right pane, select Enable Recycle Bin.
4.Click OK to dismiss the warning.
5.Click OK to dismiss the warning about replication latency.
Project Summary
The exercise resulted in three key Active Directory security configurations.
The domain-wide password requirement was updated to 14 characters through the Default Domain Policy.
A separate Fine-Grained Password Policy named Domain Admin Password Policy was created with a precedence of 1.
The Domain Admins group was assigned the stricter policy with a 16-character minimum password length.
The configuration demonstrated the ability to apply different password requirements to specific security groups.
The Active Directory Recycle Bin was also enabled from Active Directory Administrative Center.
These changes produced a more structured approach to password enforcement and directory-object recovery.
The completed configuration provides a practical record of Active Directory security policy administration.
Top comments (2)
This is a strong example of moving beyond basic user management into real security practices. Applying stricter requirements to privileged accounts while enabling recovery capabilities demonstrates a solid understanding of identity protection and directory resilience.
The combination of domain password policies, fine-grained controls, and Recycle Bin shows how security and recovery can be built directly into an AD environment.