I found this article: AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide really useful to set fine-grained password policies for a user or a Security Group.
But I haven't found any way to do this at an OU level - at least not any way that I can get it to work.
Any good articles that show how to do this?