Password settings object. Holds fine-grained lockout and password rules aimed at global groups or users; if several apply, the smallest precedence number takes effect.
Also called Password Settings Object.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains PSO in context, with comparison tables and the common traps.
Terms in this definition
- AGDLP
Nesting pattern: users go into global groups, which go into domain local groups, which receive the permissions. AGUDLP adds universal groups for forests with several domains.
- APPLY
Evaluates a table-valued expression for every row on its left, inside
FROM. Think ofOUTER APPLYas a left outer join andCROSS APPLYas an inner join.
Related terms
- Fine-grained password policy
Lets particular users or global security groups (but not OUs) have their own password and lockout rules, overriding the domain default. The settings live in a Password Settings Object.
- msDS-PasswordSettingsPrecedence
A required attribute on every password settings object that sets its rank; when more than one object targets a user, the smallest number takes effect.
- msDS-ResultantPSO
A calculated attribute on a user account revealing the password settings object that is really in force for that user.