Re: Account Lockout Policy

From: Rasmus Rønlev (rr.it_at_cbs.dk)
Date: 10/20/05

  • Next message: Tony King: "RE: security policy 'not specified' option" 
    Date: Thu, 20 Oct 2005 23:36:38 +0200
To: focus-ms@securityfocus.com

    Hi,

    Since everyone seems to have differing oppinions this is almost turning
    into FUD ;o)
    It seems some of the responding people are knee-jerk-reacting to "you
    can only put into effect account policy from the domain level". This is
    correct in so far that "Domain Policy" will be applied towards Domain
    Controllers, sitting in the Domain Controllers OU.

    However, as others pointed out, the question was pertaining a MEMBER
    SERVER and its local account database. You can apply this on OUs just
    fine. The closest (the last GPO to be applied) will take precedence.
    Ofcourse if you do apply a GPO on an OU level you need to be aware, that
    it'd apply it on all contained objects - so move the server into a
    seperate OU and link a new GPO with the account policy settings you want
    and viola :)

    As has been emphasized, the difference is between DOMAIN accounts (those
    that sit on the DCs) and the LOCAL accounts (those that sit on the
    individual member servers and workstations).

    r@smus

    .
    Rasmus Rønlev
    Copenhagen Business School, CBS-IT

    RAMI KHANFER wrote:

    >You can not configure account policy on OU; the only place where you can
    >configure account policy is at the domain level.
    >
    >Best Regards
    >Rami Khanfer
    >
    >MobileCom - IT Direction/ Infrastructure Department
    >Mobile + 962 777 801539
    >Email Rami.Khanfer@mobilecom.jo
    >
    >-----Original Message-----
    >From: Derick Anderson [mailto:danderson@vikus.com]
    >Sent: Thursday/October/2005 05:59 PM
    >To: Shabbar Arsiwala; focus-ms@securityfocus.com
    >Subject: RE: Account Lockout Policy
    >
    >
    >
    >
    >
    >>-----Original Message-----
    >>From: Shabbar Arsiwala [mailto:sarsiwala@obleness.org]
    >>Sent: Thursday, October 20, 2005 9:07 AM
    >>To: focus-ms@securityfocus.com
    >>Subject: Account Lockout Policy
    >>
    >>-----BEGIN PGP SIGNED MESSAGE-----
    >>Hash: SHA1
    >>
    >>We have an account lockout policy setup for users on our
    >>domain Win 2K3 / Active Directory environment. 4 invalid
    >>attempts the account locks out / 30 mins the account is
    >>released. We would like to change this policy for one the
    >>machines on our domain. This machine uses a local
    >>administrator account to log in.
    >>
    >>Is this possible ???
    >>
    >>Thanks,
    >>Shabbar
    >>
    >>
    >
    >It is possible to change the *local* machine account lockout policy for
    >a specific machine, but not the *domain* lockout policy. To do this you
    >need to put your *domain* password policy in the Domain Controllers OU,
    >create a separate OU for this one machine, make a new policy with the
    >desired lockout settings, and link it to the single machine's OU. This
    >will only work for *local* accounts (such as MACHINE\Administrator), not
    >*domain* accounts (DOMAIN\Administrator).
    >
    >Derick Anderson
    >
    >------------------------------------------------------------------------
    >---
    >------------------------------------------------------------------------
    >---
    >
    >
    >
    >
    >---------------------------------------------------------------------------
    >---------------------------------------------------------------------------
    >
    >
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Tony King: "RE: security policy 'not specified' option"

    Relevant Pages

    • Re: GPO causing client security logs to fill?
      ... a virus in play. ... settings to be applied on your client workstations. ... Group Policy is a complex and often misunderstood beast. ... I modified the account ...
      (microsoft.public.windows.server.sbs)
    • Re: Passowrd complexity LOCAL Account
      ... Place this computer account into an OU. ... Then, link a new GPO to the OU, ... configuring the GPO's Account Policy like you want the local SAM to behave. ... > local user accounts with passwords that do not follow the ...
      (microsoft.public.win2000.group_policy)
    • Re: starting over with GPO
      ... Your description does not take into account the concept of Group Policy ... you would only need to link the Domain GPO to the domain and Users ... See the following link for a description of Group Policy Inheritance: ...
      (microsoft.public.windows.group_policy)
    • Re: Domain Admin account and lockout Policy
      ... have different account policies for different domain user accounts, ... Topics, Group Policy Management, Concepts, Group Policy Object Editor ... Default Domain Policy Group Policy object (GPO) or in a new GPO that ...
      (microsoft.public.windows.group_policy)
    • Re: Domain Admin account and lockout Policy
      ... have different account policies for different domain user accounts, ... Topics, Group Policy Management, Concepts, Group Policy Object Editor ... Default Domain Policy Group Policy object (GPO) or in a new GPO that ...
      (microsoft.public.windows.group_policy)
    • Quantcast