# Fine-grained password policy setting counts should be retrievable

Having a detailed breakdown of fine-grained password policy settings allows you to:

Source: https://maester.dev/docs/tests/AD-FGPP-03

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Password policy · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-FGPP-03
```

## Overview

Having a detailed breakdown of fine-grained password policy settings allows you to:

- **Audit security levels**: Verify that privileged accounts have stronger policies
- **Identify misconfigurations**: Spot policies that may be incorrectly configured
- **Ensure compliance**: Validate that all policies meet minimum security requirements
- **Document coverage**: Understand exactly what controls are in place

This detailed view complements the value count by showing the actual settings rather than just the number of variations.

#### Control Type

**Operational**

#### Security Recommendation

When reviewing fine-grained password policy settings, ensure:

| User Type | Min Length | Max Age | History | Complexity | Lockout Threshold |
|-----------|------------|---------|---------|------------|-------------------|
| Domain Admins | 15+ | 60 days | 24+ | Enabled | 3-5 |
| Service Accounts | 20+ | Never | 24+ | Enabled | 3-5 |
| Regular Users | 14+ | 90 days | 24 | Enabled | 5 |

To review and modify policy settings:
1. Open **Active Directory Administrative Center**
2. Navigate to **System** > **Password Settings Container**
3. Double-click each policy to review settings
4. Adjust as needed to meet security requirements

#### How the Test Works

This test retrieves all fine-grained password policies using `Get-ADFineGrainedPasswordPolicy` and creates a table showing key settings for each policy:
- Policy name
- Minimum password length
- Maximum password age (in days)
- Password history count
- Complexity enabled (Yes/No)
- Lockout threshold

#### Related Tests

- `Test-MtAdFineGrainedPolicyCount` - Counts the number of FGPPs
- `Test-MtAdFineGrainedPolicyValueCount` - Shows distinct values across policies
- `Test-MtAdFineGrainedPolicyAppliesTo` - Shows which users/groups each policy applies to

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-FGPP-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Password policy |
| Area | Authentication |
| Resource type | Policy |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdFineGrainedPolicySettingCounts](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-FGPP-03.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:msDS-PasswordSettings:ReadProperty |

</details>

## Source

- Test: [`tests/ad/password-policy/Test.AD-FGPP-03.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-FGPP-03.ps1)
- Documentation: [`tests/ad/password-policy/Test.AD-FGPP-03.md`](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-FGPP-03.md)