Fine-Grained Password Policy

The FGPP applied directly to a user takes precedence over the FGPP applied to the group in which the user is a member.

If more than one FGPP is applied to a user, then the FGPP with the lowest msDS-PasswordSettingsPrecedence will be applied.

If two FGPPs with the same msDS-PasswordSettingsPrecedence are applied to a user, then the FGPP with the smallest GUID (Globally Unique Identifier) will be applied to the user.

To determine which FGPP is applied to a user, an attribute called msDS-ResultantPSO can be used.

It holds the distinguishedName of the FGPP applied to the user.