Re: Secure Channel Password

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 12/10/04 

Date: Fri, 10 Dec 2004 06:33:23 -0700

I knew that the default is to provide membership safeguard by
retaining machine account passwords two deep, so the auth can
be with the prior if the password presented by the machine does
not match the current password. This provides for a little tolerance
for such as reimaging, etc..
What I did not know was that the account would be disabled if
two password changes were missed, and I have to question this.
One can disable, on a per-machine (or OU via GPO) basis whether
a machine will change its password at all. This means if there is
such a disabling, then the mechanism could not be blind to the
policy under which the machine that has not changed it password
operates, etc. - all becoming a little complex. Of course, if this
is so, that also means that if a machine is not booted for a couple
months then its membership is automatically defunct. 

-- 
Roger Abell
"Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
news:NxPtd.160071$V41.127540@attbi_s52...
> By default the computer account passwords used for secure channel in a
> domain are changed by the computer every thirty days. My understanding is
> that if it computer misses the password change interval twice the domain
> controller will disable the computer account. The netdiag support tool
when
> run on a domain computer will detect if the secure channel to the domain
is
> in place or not.  --- Steve
>
>
> "Amir Marathonian" <AmirMarathonian@discussions.microsoft.com> wrote in
> message news:4AF99BD3-828D-43A4-98E7-4A11D7507BDD@microsoft.com...
> > Hi,
> >
> > Does the Secure Channel Password change whenever one restarts the
server?
> >
> > Thanks
>
>

Relevant Pages

  • Re: Secure Channel Password
    ... >I knew that the default is to provide membership safeguard by ... > retaining machine account passwords two deep, ... > such a disabling, then the mechanism could not be blind to the ... >> run on a domain computer will detect if the secure channel to the domain ...
    (microsoft.public.win2000.security)
  • Re: Account Lockout Policies
    ... and password change intervals so they are the same, ... read accounts with expired passwords and verify they are disabled. ... of first expiry of the pwd, disabling only upon an ...
    (microsoft.public.security)