Windows Server / Active Directory & Group Policy
Check effective fine-grained password policy for a service account
A service account's password behavior may differ from the default domain policy because a fine-grained policy applies.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Get-ADUserResultantPasswordPolicy -Identity app_serviceRead the result
With the ActiveDirectory module, this returns the applicable fine-grained policy when one is assigned. No result requires checking the default domain policy separately.
Resolve and verify
Compare expiry and lockout behavior with the account's approved service design. Coordinate any policy or credential change with all secret consumers.
Before changing production
Do not weaken the domain-wide policy to accommodate one application or assume no fine-grained result means no policy exists.