Password Policy 3

[riddock55]

Hi,

2 Questions..

1) I need to change the password policy of our windows 2003 domain. If users have "password never expires" option ticked in their user accounts, will group policy over ride this if I put a max password age of 6 months on it?

2)Can remote users connected to network via VPN chnage their passwords any way?

Thanks
Nick

 

[lhuegele]

Having a user account with the "password never expires" check-box turned on basically bypasses what you have set in your group policy.

(my guess) - Remote users connected via a VPN connection should be able to change their passwords manually but only if the appropriate ports and protocols are allowed over the VPN tunnel. The more I think about this though the more I don't think it's possible because they have to log-in to their machines before the VPN connection is even established. This means they are using a local account or cached network credentials. Good question someone else may be better able to answer.

Good luck,

 

[wcburton]

If they are using cached network credentials then they can change their password. Once connected to the VPN and hence the domain, they can press CTL+ALT+DEL and choose change password. After the password is changed, they can lock the computer and then unlock it with the new password. That will sync the new password to the laptop.

(And the previous is correct that "password never expires" wins out over password age)

 

[riddock55]

Thanks Guys..

Another question if you dont mind..

When I change the max password age to 6 months, will this affect the accounts after I deselect the password never expires options.

ie will the passwords take into account the length of time they have already been active..

I hope this makes sense.

 

[sutors]

Yes, when user logs in, last password change date (pwdLastSet attribute) is checked against current password policy. If last password change date +6 months have passed current date, the user will get prompted to change his password.
Most other password policy settings, eg password min/max length are only enforced during next password change.

Lukasz