Re: Enforce Password Aging... Gracefully


You could write a script to change the pwdLastSet attribute for all users to
a date that is within 90 days of the date when the policy is enforced. Set
the policy to prompt users 14/20 days or whatever before the password
expires. There will then be no immediate effect when you enforce the policy
and users will be prompted a set number of days before the passwords expire.

As said before you cant do this OU by OU as if you set some pwdLastSet
attributes and enforce the policy the ones you didnt set will be expired
immediately.

The tricky bit however is setting the pwdLastSet attribute. This will need
to be done via a script. The pwdLastSet attribute is an Interger8 (64 bit)
value which represents the number of 100 nanoseconds intervals between when
the password was last set and January 1st 1601. You would need to do a bit
of maths to work out what value you would need to set it too. You should be
able to find some guides for setting this attribute if you search for
pwdLastSet.

Best Regards
Joe Dunn MCSE


"Mr_Huang" wrote:

Hi Joe,
all i want is to have alerts when the user logon or (even lock the
screen) before the password expires, is it possible to do so?
since i'm not much familiar with the vbscripting, not sure if i could
write a script and change the expiry date manually with certain OU, so
i can roll out this phase by phase.
Thanks,
huang

On Dec 6, 5:13 pm, jwd <j...@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
If the users passwords are more than 90 days old when you enforce the policy
then they will be expired and the users prompted to change the next time they
login. This can not be done OU by OU as the password policy is domain wide.

There is no "grace period" policy setting as you mention - if the passwords
are older than the policy allows they will be expired. What you can do
though is inform your users maybe several weeks before hand that this policy
will be enforced and ask them to change their passwords on their own accord.
These passwords will then not be expired when you enforce the policy as they
are within the 90 days. If people choose to ignore this then they will be
forced to change if their passwords are more then 90 days old when you
enforce the policy.

If the passwords are younger than 90 days but do not match the length and
complexity requirements then they will not be forced to change when the
policy is enforced as these requirements are only checked when the password
is set.

Best Regards
Joe Dunn MCSE


.

Relevant Pages

  • Re: Locking down database accounts
    ... Personally it sounds to me that your company has established a policy and is ... But bottom line if you have to use SQL Server logins and passwords, ... Whether it's an encrypted flat file or an encrypted XML file, ...
    (microsoft.public.sqlserver.security)
  • RE: policy-based password cracker
    ... that required at least one upper, one lower and one number in all passwords. ... password checks can be eliminated due to the policy. ... Since the vast majority of the time for a brute-force attack is ... most brute-force attacks are very fast. ...
    (Pen-Test)
  • Re: Security hierarchy
    ... OK - last night I managed to reset the password policy. ... I had to boot into DS restore mode in order to be able to access the ... New users had to have complex passwords. ... >> I have tried all the suggestions plus a new top GPO at domain level ...
    (microsoft.public.win2000.security)
  • Re: GPO Password length not working
    ... For "domain users" password account policy is set only at the domain level. ... Usually this is Default Domain Policy but it can be any Group Policy linked ... You can use the command net accounts on a domain controller to see the ... > passwords or anything goes pretty much. ...
    (microsoft.public.windows.server.security)
  • Re: Sharing folder permission ????
    ... XP blocks network access to accounts that have blank ... you can do so through Local Security Policy. ... Limit local account use of blank passwords to ... When I click my Xp system visible in default>>woprkgroup, I get a login windows whcih identify me on> the ...
    (microsoft.public.windowsxp.security_admin)