Fw: Setting Account Lockout Policies with a NT PDC

From: Jason Radtke (crd427@hotmail.com)
Date: 07/29/02 

From: "Jason Radtke" <crd427@hotmail.com>
To: <keydet89@yahoo.com>
Date: Mon, 29 Jul 2002 13:35:35 -0400

I apologize for not being clear. I have already configured the account
lockout policies for the domain user accounts but I want to set the
workstation local accounts (the local admin account is the only active local
account) to specific lockout policies (account lockout duration, account
lockout threshold and reset account lockout counter) without having to go to
each computer to configure.

If the admin account is locked out then it is suppose to only allow an
administrator infront of the computer to logon (no network attempts via the
local admin account).

> -----Original Message-----
> From: H C [mailto:keydet89@yahoo.com]
> Sent: Friday, July 26, 2002 5:56 PM
> To: Jason Radtke; focus-ms@securityfocus.com
> Subject: Re: Setting Account Lockout Policies with a NT PDC
>
>
> Jason,
>
> After reading through your post, I'm having some
> trouble seeing where you're finding the difficulty,
> exactly. When you connect the Win2K client to the the
> NT PDC, you seem to be thinking that the settings for
> the domain account will be ignored simply b/c the
> client is Win2K. This is NOT the case.
>
> If you want to set the account lockout policies for
> the NT PDC, simply go to the PDC, open User Manager
> for Domains, click Policies, then Accounts. Then set
> your account lockout settings. Yes, this can also be
> done via a variety of scripts.
>
> Changing the local Admin passwords on the clients is
> also pretty simple w/ a Perl script that uses the
> Win32::Lanman module.
>
> --- Jason Radtke <crd427@hotmail.com> wrote:
> >
> >
> > I am looking for assistance in changing the account
> > lockout policy
> > settings for my end users.
> >
> > PDC is a Windows NT Server
> > 80% workstations Windows 2000
> > 20% workstations Windows NT4 (at the end of a
> > migration stage to Windows
> > 2000, so I am not worried as much about changing the
> > policies on the nt4
> > workstations)
> >
> > I came across a thread with a tool called
> > "AccountPolicy 0.2" but it
> > appeared to be for a complete Windows NT4
> > environment
> >
> > I also read on a previous thread that you can change
> > the workstation local
> > admin passwords via a script. Is this able to be
> > done with a NT Server to
> > Windows 2000 workstations and if so can someone
> > point me in the right
> > direction.
> >
> > Thanks in Advance
>
>
> __________________________________________________
> Do You Yahoo!?
> Yahoo! Health - Feel better, live better
> http://health.yahoo.com
>

Relevant Pages

  • Re: Username Vulnerability???
    ... Open Server Manager> highlight the PDC ... Password Policy and Account Lockout Policy are both ...
    (microsoft.public.windows.server.general)
  • Re: OU group policy and how to use ldapsearch to find GPO settings
    ... The account is a domain account. ... Account Policies effective for all domain accounts. ... Your ldap query is seeing the settings that are in use for the domain. ... If I configure the account lockout policy in the default domain policy, ...
    (microsoft.public.windows.group_policy)
  • Re: Replication of password resets/unlocks
    ... Assuming that the reg key AvoidPDCOnWan isn't set passwords will be sent immediately out of band to the PDC when changed on a local machine. ... I haven't dug into the specifics but I believe that occasionally it will check with the PDC to see if the account has been unlocked but not for every auth attempt, this is so a PDC will not be overwhelmed by attempts to auth a locked account. ... The idea behind auto lockout is to prevent brute force systems from sending thousands of passwords an hour to crack a password, if that is the case, then setting the lockout policy to 25 bad attempts and locking the account out for say 5 minutes is just as good from a security perspective; it will seriously impact the ability for a brute force attack. ... From the usability standpoint, it will only lockout users who have really screwed up with their password and give them just enough time to realize they really screwed up but take less time than a call to the helpdesk for an unlock and replication of the unlock meaning that if they call the helpdesk for a rest, the only mechanism that comes into play is the one in the first paragraph above which works fine. ...
    (microsoft.public.windows.server.active_directory)
  • Re: 2003 Server Client/Delegation and Data Issues
    ... "reveal" the read and write lockout time permissions. ... I have an account that I ... default - no mention of domain users. ...
    (microsoft.public.windows.server.active_directory)
  • Re: lockaccount flag in userAccountControl does not change
    ... Neither has explicit support for dealing with lockout though. ... The IADsUser interface in ADSI attempts to support it, ... checks to see if lockoutTime has a value or not and assumes the account is ... For more information on unlock, ...
    (microsoft.public.windows.server.active_directory)
Loading