Re: Password policy at the OU level

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 07/16/04 

Date: Thu, 15 Jul 2004 18:12:13 -0700

Service accounts usually have the account attribute that
their password never expires set on, which exempts them.
The challenge is then in remembering to actually not leave
the services running with the same password forever. Use
of a very strong passphrase helps here.

You user Peter is in a pickle, or perhaps it is you that is.
I would suggest that either you get their outbound VPN
ability defined and functioning, or that you let then be
stand-alone rather than domain. As it is, the machine is
not receiving GPO from the domain, and is likely totally
out-of-touch with the domain - so why is it in the domain?
The user can still authenticate at the RPC/HTTP interfaces
with their domain account even though they do not log into
their machine with same. As it is, if you have not yet
enforced password policies, Peter's machine is not going
to discover that these are in place, and anyway, domain
password policy is enforced at the domain controllers. 

-- 
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"SF '03 Native" <anonymous@discussions.microsoft.com> wrote in message
news:2e1f901c46a7e$c8bd76e0$a301280a@phx.gbl...
> OK then.  How do I handle service accounts?  Exchange for
> example...  What are the implications of Domain level
> password policies for service accounts?
>
> And one more question if I may.
>
> I have a user (Peter) that is behind such a tight
> firewall (Checkpoint) that he cannot VPN in here PPTP.
> His only choice is to use RPC over HTTP.  How will a
> password policy forcing him to change it every 90 days
> work?
>
> I want to put to you my theory:
>
> Peter's machine is a member of the Domain, but almost
> never gets connected to the domain.  If he is forced to
> change his password via RPC over HTTP will his local
> machine also know about the change, or will he be forced
> to use 2 different passwords.  The old one to log into
> the machine and the new one to connect his Outlook?  Or
> will the resulting confusion cause a space time rift and
> render his machine inoperable?
>
> This is my greatest obstacle to inplementing a secure
> password policy.  Please help me answer this question.
> Thank you.
>
> >-----Original Message-----
> >That's right. Password policy for domain user accounts
> must be assigned
> >within a GPO linked to the  domain level only. OU-linked
> password policy
> >will only affect local user accounts on workstations and
> member servers.
> >
> >-- 
> >Darren Mar-Elia
> >MS-MVP-Windows Management
> >http://www.gpoguy.com
> >
> >
> >
> >"SF '03 Native" <anonymous@discussions.microsoft.com>
> wrote in message
> >news:2cff001c469ec$39472a20$a401280a@phx.gbl...
> >> When I assign a password policy at the OU level it has
> no
> >> effect whatsoever.  Is this not supposed to work?
> >>
> >> Is my only option to set it at the Domain level?
> >>
> >> I am on Windows 2003 Native Mode with Exchange 2003
> >> Native mode as well.
> >
> >
> >.
> >

Relevant Pages

  • Re: Where to set the domain password policy up?
    ... Account Policies applied to Domain Controllers apply to all accounts stored on domain controllers - that is, to all domain accounts in that domain! ... I'd say apply at the domain level still - to have consistent policy for domain accounts in the domain as well as for local accounts on all computers in that domain. ... > Is it better to set a domain password policy up at the domain node level ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain Groups For Clustering Service ???? SQL Server 2005
    ... You need to manually add the service accounts you specify during setup into ... services then just add that to each of the 3 domain groups you create. ... Jasper Smith (SQL Server MVP) ...
    (microsoft.public.sqlserver.clustering)
  • Re: Password policy in domain 2003
    ... there is only one account and password policy for domain accounts. ... If one sets these at a different level (not at domain level) such as ... have impact on machine local accounts defined on the computers ...
    (microsoft.public.security)
  • RE: Group Policy: multiple password policies in the same domain?
    ... There can be only one password policy for the domain. ... Subject: Group Policy: multiple password policies in the same domain? ... I'm trying to lock down some domain "service" accounts (backup, ... time I'm trying to enforce stronger passwords for service accounts like ...
    (Focus-Microsoft)
  • Re: Password policy clairification?
    ... AD Password Policy it's applied at domain level and doesn't matter whether it is showing up as configured on the PCs because the AD accounts aren't stored on the PCs they're stored on domain controllers. ...
    (microsoft.public.windows.server.active_directory)