 If User1 changes their password, the new password must have at least 10 characters. No

 If User2 changes their password, the new password must have at least seven characters. Yes

 If User3 changes their password, the new password must have at least 13 characters. No

The Windows Server Hybrid Core Infrastructure materials explain that Account policies (Password Policy, Account Lockout Policy, and Kerberos Policy) are domain-wide and are processed only from the GPO linked at the domain root (typically the Default Domain Policy). The guide states that “password policy settings for domain user accounts are obtained from the domain account policy; GPOs linked to OUs do not change the domain password policy for user objects.” It further clarifies that OU-linked GPOs containing Account Policy settings affect only the local Security Accounts Manager (SAM) of computers whose computer objects are in that OU—not the passwords of domain user accounts. In Microsoft Entra Domain Services (managed domains), you also see the built-in AADDC Users GPO and AADDC Computers GPO; however, the same scope rules apply: domain users’ password length is determined by the domain account policy, while local accounts on member servers/workstations inherit Account Policy from the GPO that applies to the computer object’s OU.

Applying these rules to the scenario:

User1 is a domain user under AADDC Users OU. Even if that OU GPO set 10 characters, it does not override the domain account policy → No.

User2 is a local user on Server1. The computer object (typically under AADDC Computers) receives its Account Policy from the AADDC Computers GPO, which sets minimum length = 7 → Yes.

User3 is a domain user under OU1 with GPO1. OU-level Account Policy (e.g., 13 characters) does not affect domain user passwords → No.