RE: Account Lockout Policy

From: Laura A. Robinson (larobins_at_bellatlantic.net)
Date: 10/21/05

  • Next message: Laura A. Robinson: "RE: security policy 'not specified' option" 
    Date: Thu, 20 Oct 2005 18:15:11 -0400
To: "'Bates, Chris'" <Chris.Bates@nwdc.net>, <focus-ms@securityfocus.com>

    Actually, the local admin account can be locked out (at least post-2000).
    Test it out. :-)

    Laura

    > -----Original Message-----
    > From: Bates, Chris [mailto:Chris.Bates@nwdc.net]
    > Sent: Thursday, October 20, 2005 1:48 PM
    > To: focus-ms@securityfocus.com
    > Subject: FW: Account Lockout Policy
    >
    > You can change the local policy on the machine, or filter a
    > GPO to only apply to that machine.
    > But if they are using the hardcoded local admin, it can't be
    > locked out.
    > MS Safety feature I guess.
    >
    >
    > ----------------------------------------------------------------------
    > Chris Bates (CISSP)
    > Infrastructure Management Consultant
    > ACS Inc. (Enterprise Services; NWDC)
    > Chris.Bates@nwdc.net
    >
    >
    > -----Original Message-----
    > From: Derick Anderson [mailto:danderson@vikus.com]
    > Sent: Thursday, October 20, 2005 8:59 AM
    > To: Shabbar Arsiwala; focus-ms@securityfocus.com
    > Subject: RE: Account Lockout Policy
    >
    >
    >
    > > -----Original Message-----
    > > From: Shabbar Arsiwala [mailto:sarsiwala@obleness.org]
    > > Sent: Thursday, October 20, 2005 9:07 AM
    > > To: focus-ms@securityfocus.com
    > > Subject: Account Lockout Policy
    > >
    > > -----BEGIN PGP SIGNED MESSAGE-----
    > > Hash: SHA1
    > >
    > > We have an account lockout policy setup for users on our domain Win
    > > 2K3 / Active Directory environment. 4 invalid attempts the account
    > > locks out / 30 mins the account is released. We would like
    > to change
    > > this policy for one the machines on our domain. This machine uses a
    > > local administrator account to log in.
    > >
    > > Is this possible ???
    > >
    > > Thanks,
    > > Shabbar
    >
    > It is possible to change the *local* machine account lockout
    > policy for a specific machine, but not the *domain* lockout
    > policy. To do this you need to put your *domain* password
    > policy in the Domain Controllers OU, create a separate OU for
    > this one machine, make a new policy with the desired lockout
    > settings, and link it to the single machine's OU. This will
    > only work for *local* accounts (such as MACHINE\Administrator), not
    > *domain* accounts (DOMAIN\Administrator).
    >
    > Derick Anderson
    >
    > --------------------------------------------------------------
    > ----------
    > ---
    > --------------------------------------------------------------
    > ----------
    > ---
    >
    >
    >
    >
    > --------------------------------------------------------------
    > -------------
    > --------------------------------------------------------------
    > -------------
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Laura A. Robinson: "RE: security policy 'not specified' option"

    Relevant Pages

    • Re: account lockout gpo
      ... > I had the account lockout policy enabled for the default ... Turn on Account Logon Auditing and count the failures. ... AUTHENTICATION failures. ...
      (microsoft.public.win2000.active_directory)
    • RE: Account Lockout Policy
      ... You can not configure account policy on OU; the only place where you can ... MobileCom - IT Direction/ Infrastructure Department ... > Subject: Account Lockout Policy ...
      (Focus-Microsoft)
    • Re: Account Lockout Policy
      ... Why don't you put the Administrators and Users into different groups ... and apply the Account Lockout Policy to the Group? ...
      (microsoft.public.windows.server.security)
    • Re: Account Lockout Policy
      ... Why don't you put the Administrators and Users into different groups ... and apply the Account Lockout Policy to the Group? ...
      (microsoft.public.win2000.security)
    • Re: Restricted Groups...with exceptions
      ... one has a separate policy for access restrictions, IPSec, etc. ... now my requirement is certain users need local admin access to all PCs ... multiple sites and then I assume i'd need to manually add my global groups) ...
      (microsoft.public.win2000.group_policy)