Fine-grained password policies (PSO)

The domain default password policy applies to everyone. When you want stricter rules for admins without a second domain, use a Password Settings Object. A PSO links to a user or group and wins over the domain policy for those members.

Create one for admins

New-ADFineGrainedPasswordPolicy -Name "PSO-Admins" `
  -Precedence 10 `
  -MinPasswordLength 16 `
  -PasswordHistoryCount 24 `
  -LockoutThreshold 5 -LockoutDuration "0.00:15:00" `
  -MaxPasswordAge "30.00:00:00" -ComplexityEnabled $true

Add-ADFineGrainedPasswordPolicySubject -Identity "PSO-Admins" `
  -Subjects "Tier0 Admins"

Precedence

If a user ends up in two PSOs, the lower Precedence number wins, not the stricter policy. A direct user link always beats a group link. Check what actually applies to someone with:

Get-ADUserResultantPasswordPolicy -Identity jdoe

Apply PSOs to groups, not individual users, so membership changes do the work for you. And keep the number of PSOs small, because untangling overlapping precedence later is miserable.