problem understanding pwd mgmt

[tekkanet]

I have problems understanding how pwd mgmt and expiration checks are performed.
I inherited a w2k3 sp1 server that is also domain controller and that is also the exchange server (2003 sp1).
There is only one domain in the forest.
Diving into documentation and searching through the internet I found references to:

1) the "accountexpires" attribute of a user that defaults to never in my domain (1/1/1970 that is interpreted as never expire for m$ weirdness or nt inheritance...who knows) but I can set it for a user, using act dir user and comp, selecting the user and selecting the accout tab, then setting the date inside "Account expires" frame.
For example end of 11 Dec 2006.
And I see in ADSIEdit that the value now is 128103516000000000 (marvellous decision the 100th of nanoseconds since 1/1/1601 12am date rapresentation, well done....)

2) the computed value, derived from "maxpwdage" (that is negative number) domain attribute and "pwdLastSet" attribute for the user.
pwdLastSet-maxpwdage gives the date when the account will expire
In my example they are -43200000000000 (-50 days) and 128008193462031250 (Wed Aug 23 17:09:06 2006), so that the password should expire at Thu Oct 12 17:09:06 2006...

I thought these were two aspects of the same medal, but it doesn't seem so.
a) If for example I access the domain account mailbox from internet explorer, I receive the warning that the password is expiring in xxx days, that is consistent with 2) (in another example where effectively the user is in expiration notification range, not in this particular one)
b) if i log in in a workstation of the domain with the same user and change the password, I see that pwdlastset attribute is updated but not the accountexpires one. Should instead this happen?

Can anyone clarify, please?
Thanks in advance
Gianluca

 

[crobin1]

The "Account Expires" is not related to the password, but is related to disabling an account. For instance, you know an employee's last day is Friday August 25th. If you set the account to expire at the end of Friday, then on Saturday that person will not be able to log on with that account. That way you don't have to connect in to the office on Saturday to disable the account.

The "Account Expires" attribute can not be affected by the user.

 

[tekkanet]

Thanks for your answer. So, for normal users, who typically don't leave the company at a known date, I had better to set never expire, hadn't I? Is this what exch admins tipically do or suggest?
Another question:
On link

http://www.windowsecurity.com/articles/Understanding-Roles-Server-2003-Security-Policies.html

it is stated:
[snip]
Domain Controller Security Settings: You use this interface to configure security settings for the domain controllers in the domain. These settings take precedence over the Domain Security Policy for DCs. This interface is accessed by logging onto the domain controller as an admin and selecting Domain Controller Security policy from the Administrative Tools menu.
[snip]

But in my system, connecting to the unique dc as admin
inside domain controller security policy, I can see under account policy--> password policy, there are
maxpwdage 59 days
minpwdage 1 day

instead under domain security policy there are
maxpwdage 50 days
minpwdage 0 day

And when a user changes the password, the second is applied.... so what stated at the link seems wrong...?

running gpedit, for the local policies, they are correctly grayed out preventing to change them.

 

[Spirit]

For each domain there can be only one password policy, that is the default domain policy which can be seen at the top level of the GPO editor.

You can make changes to this anywhere you like down the tree's but they are just totally ignored.

The only way to have different password policies age, length, complexity etc. is to create another domain.

Iain

 

[crobin1]

Yes, typically accounts are set to never expire.

The article you linked to is correct.

The "Domain Security Policy" is a set of policies that cover everything in a particular domain, including servers, workstations, and user accounts.

The "Domain Controller Security Policy" is just that, it is a set of policies that apply only to domain controllers (specifically, the Domain Controllers OU). It can be used to override settings in the "Domain Security Policy".

For example, in our setup under "Domain Security Policy", maxpwdage is set to 60 days, and in the "Domain Controller Security Policy" that setting is undefined. In the "Domain Security Policy" under Local Policy\Audit Policy no settings are defined. In the "Domain Controller Security Policy" several auditing policies are turned on so that the DCs will log specific events (such as creating/deleting accounts).