Solved

Windows Maximum Password Age

Posted on 2011-02-26
10
647 Views
Last Modified: 2012-05-11
Hi, I am trying to setup security policies on a XP machine and I have the following question.  I have two accounts (both Admin) but one with a blank password, and the other with a regular password.  I need to enforce a "maximum password age" policy, and I found where you set that up in the registry
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters]

Open in new window

maximumpasswordage

Open in new window

but my real question is, if I have this set to say 90 days, will it enforce this policy for any accounts that have a "blank" passwords or only for one's that have a real password associated with the account.

My issue is, the account with the blank password needs to auto-login everytime, and I don't want to have a situation where on day 90 it does not auto-login and hangs-up because it needs to have a password changed...

Please help :)
0
Comment
Question by:arunykand
  • 5
  • 4
10 Comments
 
LVL 10

Accepted Solution

by:
abbright earned 500 total points
Comment Utility
I believe that the password expiry options acts on all accounts whether they have a password set or not. If you want to prevent this for a single account you can set the "password never expires" option on the account itself. Then it won't expire even after the 90 days.
0
 
LVL 41

Expert Comment

by:graye
Comment Utility
I'm pretty sure that the Maximum Password Age is a "global" setting... that affects all acounts.

So, I'd be thinking that it *would* mess up your auto-login at the end of 90 days
0
 

Author Comment

by:arunykand
Comment Utility
Ok, so I would go to the account ( via control userpasswords2) with the blank password and check the 'password never expires' and then make the registry edit that I mentioned above, and that will enforce the password expiry date globally, but will not affect any accounts with the 'pwd never expires' option checked? Is that correct?

BTW, i've noticed that if I run the reg mod I mentioned in my post, it changes the reg entry, but it does not change maximum password age under local security settings, why is that?
0
 
LVL 10

Expert Comment

by:abbright
Comment Utility
yes to the first question. Regarding the second there is a long discussion about this topic here: http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_22066588.html
0
 

Author Comment

by:arunykand
Comment Utility
Ok got it for the first one....Now regarding the second question I had, so which one applies for maximum password age, the one that is set in the registry, or the one that is set in local security settings? (This is a stand-alone WinXP pc, no domain, etc)?  (Registry says 90 days, local sec settings displays 42)
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 

Author Comment

by:arunykand
Comment Utility
Not sure if I should update the maximum password age via registry or via local security settings since updating the registry does not seem to update the other and I was trying to avoid doing this manually via local security settings.
0
 
LVL 10

Expert Comment

by:abbright
Comment Utility
I'm not sure what the registry value does. I'd use the local security setting as that's the "official" way to do it.
0
 

Author Comment

by:arunykand
Comment Utility
Hmm, that's what I was afraid of.....I was hoping for ease of use, have all my mods in a reg file and just execute that instead of messing around with local security settings.  
0
 
LVL 10

Expert Comment

by:abbright
Comment Utility
Here's a link from Microsoft giving you the right registry setting: http://support.microsoft.com/kb/555540/en-us
0
 

Author Comment

by:arunykand
Comment Utility
Thanks for the help!
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Password hashing is better than message digests or encryption, and you should be using it instead of message digests or encryption.  Find out why and how in this article, which supplements the original article on PHP Client Registration, Login, Logo…
This paper addresses the security of Sennheiser DECT Contact Center and Office (CC&O) headsets. It describes the DECT security chain comprised of “Pairing”, “Per Call Authentication” and “Encryption”, which are all part of the standard DECT protocol.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now