Solved

Password never expires

Posted on 2011-09-09
4
983 Views
Last Modified: 2012-05-12
We have half of our users who’s passwords where set to never expire during our Win7 roll out. There is an existing policy to force passwords to change every 90 days. Most of these accounts are pass the 90 days from the time the check box for never expire was implemented. If We unchecked the box and with that policy in place what is the expected behavior?
>
- Will they be locked out immediately and be forced to log off and change their password?
    - What about remote users? Are they locked out until they get back on the domain?
- Or is the 90 days policy reset upon unchecking the box and accounts will not need to change until 90 from now?

What's the best way to avoid having all these user forced to recreate their passwords?
0
Comment
Question by:SteveKauffman
  • 2
4 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 500 total points
Comment Utility
They would need to change their password the next time they log off/logon.  They would not be locked out immediately.

I'd make sure to communicate the password policy and give them plenty of advanced notice.

Thanks

Mike
0
 
LVL 3

Expert Comment

by:arifkayaca
Comment Utility
As mkline71 said, if you unchecked the box, your user's account will not locked and remote users exactly same.

I think the best way is set maximum password age to 0 from your password policy settings, in this way your users avoid recreate their passwords.


I hope this will usefull, good luck.
0
 
LVL 53

Expert Comment

by:McKnife
Comment Utility
Wait. You are only unchecking "password never expires", right? Then nothing would happen for ninety days, the counter starts right then. If they are offline and connect to the domain again a few days later, the countdown would have work manwhilst, because it resides on the domain controller which is never offline.
0
 
LVL 53

Expert Comment

by:McKnife
Comment Utility
Oops, sorry, I totally blew it ;)
The counter in fact uses the "password last set" attribute, so (again no matter if offline or not) you might have passwords that expire at once.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now