We have already spent some time in this book updating password criteria for our domain. To accomplish this, we edited the built-in Default Domain Policy GPO, as it exists in any instance of an Active Directory domain and contains password settings by default. I bring up this topic once again to point out the fact that this prebuilt policy, Default Domain Policy, really is the best place to maintain password settings for most companies.
This mindset differs from that of any other settings. My general advice for the Default Domain Policy is "don't touch it!" You should not be throwing settings into that policy for the fun of it. In general, whenever you want to push out new settings with Group Policy it should really be from inside a brand new GPO. The exception to this rule is password-related settings. When increasing the security...