Fine-grained password policies (Password Settings Objects, PSOs) are the only mechanism that can override the Default Domain password policy for individual users. When several PSOs apply, the one whose msDS-PasswordSettingsPrecedence attribute has the lowest numeric value is selected. User1 belongs to Group1, which is linked to a PSO that requires a 7-character minimum password and has the lowest precedence among all policies shown. Although OU-level Group Policy objects or the Default Domain Policy define longer minimum lengths, they are ignored once a PSO with higher (i.e., lower-numbered) precedence applies. Therefore, when User1 changes the password, the enforced minimum length is 7 characters.

B. 8 – Defined in another PSO/GPO whose precedence value is higher, so it is overridden by the 7-character PSO.
C. 10 – Same; different PSO with higher precedence value, therefore not applied.
D. 12 – Minimum length in the Default Domain Policy; superseded by any applicable PSO.
E. 14 – Not specified for any policy affecting User1; no evidence it applies.

1. Microsoft, “Fine-grained password policies in Active Directory Domain Services,” Windows Server 2022 docs, section “Precedence and resultant password policy” (https://learn.microsoft.com/windows-server/identity/ad-ds/manage/component-updates/operate-fine-grained-password-policies).

2. Microsoft, “Step-by-Step Guide for Fine-Grained Password and Account Lockout Policy,” Windows Server 2019 version, pp. 5-6, “Determining the resultant PSO for a user.”

3. Microsoft, “Group Policy and Active Directory: Password Policy Processing,” Windows Server GPO documentation, §“Why OU-linked password settings are ignored,” para. 2.