Re: Expiring inactive accounts

Hi Raoul

"VB script look at last logon date and if it is more than 60 days
before the current day then you can have it disable the account. "

This is exactly what I want . Would be great help if I can get the script.


On 12/20/06, Raoul Armfield <armfield@xxxxxxxx> wrote:

Noaman Khan wrote:
> Hello,
>
> Depends on if system is part of AD or not. If so ensure that your
> domain security policy is set to Maximum password age for 60 days.
> Also verify your local security policy.
>
> Thanks

It sounds like he already has the 60 day policy in place. What he is
looking for is the ability to prevent someone from logging on after 60
days of inactivity.

OP:

You can probably script something like that by having a VB script look
at last logon date and if it is more than 60 days before the current day
then you can have it disable the account. This will force the user to
contact the admin to reenable the account.

I can probably dig up a quick script that will do this if you need/want it.

Raoul

>
> Noaman
>
> On 12/20/06, dubaisans dubai <dubaisans@xxxxxxxxx> wrote:
>> I want to ensure that Windows 2000 domain users who are not logging in
>> for 60 days cannot login after that without admin intervention.
>>
>> In Windows NT 4.0 I used to enable the checkbox "User must login to
>> change password" and had a password expiry of 60 days. So if somebody
>> did not change password in 60 days and came later he could not login.
>> administrator had to reset his expired password
>>
>> In Windows 2000 how do I achieve this ? I donot see this option "User
>> must login to change password" anywhere. I have set the password
>> expiry for 60 days. But somebody who logs in after 90 days also can
>> use his old password , immediately change to new one and login
>> successfully.
>>
>> or is there a better way in Windows 2000 to automatically disable
>> inactive accounts ?
>>
>


--
Raoul Armfield
rarmfield at amnh dot org


Relevant Pages

  • Re: problem with login
    ... login session" after I create their account. ... If your script is using the mkuser command, ...
    (comp.unix.aix)
  • Re: Running Login Script Problems
    ... Have you replicated the login script to all your DCs' netlogon shares? ... If the "special account" is a domain admin account, ... > all my computers in a lab. ...
    (microsoft.public.win2000.networking)
  • Re: Restricting user access to one file only
    ... Now, as far as the outline for a kiosk machine, where ... would I add a script into the exit feature that would log ... > using the clissic login. ... In order to log in an account ...
    (microsoft.public.windowsxp.security_admin)
  • Re: content advisor password corruption
    ... script appears to work when I login as admin but I ... > Hi Dru - If you just do the Supervisor password steps ONLY, ... >> family account where all the other programs are is the ...
    (microsoft.public.windows.inetexplorer.ie6.ieak)
  • Why login.bat applied to a simple user account doesnt work ?
    ... I go to the MyUserAd account and under 'profile' tab I put it on "login ... " and I see the information there that confirms the login script ...
    (microsoft.public.win2000.active_directory)