Win2k Security Template: RequireLogonToChangePassword

From: Information Security (InformationSecurity@federatedinv.com)
Date: 07/30/01 

Message-ID: <D5E5F4682E75D41185CD00D0B79DC56F04BB1A90@EXCHFED01.federatedinv.com>
From: Information Security <InformationSecurity@federatedinv.com>
To: focus-ms@securityfocus.com
Subject: Win2k Security Template:  RequireLogonToChangePassword
Date: Mon, 30 Jul 2001 13:03:17 -0400

In the [System Access] section of .inf files for the Windows 2000 security
configuration templates, there's always an entry for
"RequireLogonToChangePassword=0|1". NSA guidelines set it to 1, some other
templates set it to 0, but it never seems to appear in the Security
Configuration Templates snap-in. I've searched all over microsoft.com & the
rest of the web, but can't find any definitions for this setting.

Can anyone point to a reference for what this setting is for?

Thanks!

-----w2k_dc.inf snippet---------

; (c) Microsoft Corporation 1997-2000
;
; Security Configuration Template for Security Configuration Editor
;
; Template Name: W2KDC.INF
; Template Version: 05.00.DR.0000
;
; Revision History
; 0000 - Original
; April 2001 - SNAC version 1.01A
;
;
[Unicode]
Unicode=yes
[System Access]
MinimumPasswordAge = 1
MaximumPasswordAge = 90
MinimumPasswordLength = 12
PasswordComplexity = 1
PasswordHistorySize = 24
LockoutBadCount = 3
ResetLockoutCount = 15
LockoutDuration = 15
RequireLogonToChangePassword = 1
ClearTextPassword = 0
[System Log]
MaximumLogSize = 4194240
AuditLogRetentionPeriod = 2
...