Account passwords in AD

Question

Active Directory

Introductory next:
Domain. 2008R2 rose as the first domain controller and rustled merrily. Further, to help and secure, the 2012 server rose to it and began to replicate policies and users from the first controller successfully.
dcdiag on both DCs doesn't show any errors. There are no errors in the logs either.
On the first DC, password requirements have been corrected - Store 0 passwords, the minimum password length is 3 characters, special characters are disabled, minimum-maximum periods are disabled, encryption is disabled.
I can get a user from a snap-in or a script with a password of any complexity.
When a user tries to change the password from the machine, we get an error that the password does not meet the requirements set in the domain.
I changed the requirements in the Default Domain Policy in the Security-Accounts-Passwords section (I don’t remember exactly now, but the place is the same.)
There is a suspicion that users cannot change their password if they were authorized (% logonserver% ) by the second DC.
In which direction can you dig? ..

Answer 1

Check the domain policy, for starters. Maybe the 2012 server is not aware of this policy? For example, the domain policy is set to some OU, and the domain controller is located somewhere else.
In the GPM - Group Policy Management snap-in, right-click on the domain - change the domain controller there and see ... maybe not everything is replicated? :)

Answer 2

Toward RSoP.
Check which password policies are in the Default Domain Controllers Policy.

Answer 3

I set all the parameters in DDP for passwords to "Not set" and managed to change the password. Hooray!