"User cannot change password" Active Directory

[phuschnickens]

I'm trying to restrict 4 users from changing their passwords. For each user in active directory, i check the "user cannot change password" option within the account properties. This option is sticking for about one day (24 hrs)... then i go to double-check it and they are all unchecked again.... WHAT AM I DOING WRONG? :confused:

Thanks

[Thrax]

Do you have a password expiration GPO configured?

[phuschnickens]

Do you have a password expiration GPO configured?

not sure if i know exactly what you mean... but I do have these users set to "password never expires"

[QCH]

Group Policy Object = GPO....

Most companies have the GPO set similarly to this...

http://icrontic.com/forum/attachment.php?attachmentid=26923&stc=1&d=1239241893

I believe there is a setting to prohibit "Pass does not expire" and it may tie in the fact that the user MUST be able to reset the password. :scratch:

[phuschnickens]

0
not sure what number (off)
not sure what number (off)
3
disabled
disabled

That's how I have it set. How's that for security, ha.

But really, what's this have to do with the "user cannot change password" resetting itself?

[phuschnickens]

These are my GPO password policy settings:

26925

And this is a link to an experts-exchange thread... Active Directory - "User Cannot Change Password" keeps unchecking itself. (http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/SBS_Small_Business_Server/Q_21935501.html).

This is the answer that is listed from that link:

Where did you place the OU? You can't have any OU's outside of the default MyBusiness\Users\SBSUsers.

Generally, separate OUs are not the way to delegate additional GPOs on an SBS, instead, create a SECURITY GROUP and add users to that group that you want to modify. Then, delegate that GPO to the Security Group and make sure that the GPO is higher in the list of GPOs than the default Password Policy GPO.

This is the membership of one of the users affected by the problem:

26926

I am going to change this membership to only "domain users" and "users."

Any suggestions as to what I'm doing wrong?

thanks

[Norge]

Perhaps the maximum password age of zero is causing it to reset? If a password can be zero seconds old as a maximum that might cause a problem. For the password to never expire I would think the maximum age would be indefinite. I don't know if that is an option though. It might be worth checking in case it is something that simple.

Norge

[QCH]

I saw that too... Sometimes "0" on a max is interpreted as "No Max age".

This security setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If the maximum password age is between 1 and 999 days, the Minimum password age (http://technet.microsoft.com/en-us/library/6ac50d53-2713-4aba-8170-574e42fb2bab) must be less than the maximum password age. If the maximum password age is set to 0, the minimum password age can be any value between 0 and 998 days. See MS Doc (http://technet.microsoft.com/en-us/library/cc736566.aspx).

[phuschnickens]

Once I changed the user down to only being a member of "Users" and "Domain Users," the problem appears to be solved. Probably has not recurred since. Maybe taking the user out of "Domain Admins" was the magic.

Unrelated question and probably worthy of a new post:

Any way to view a user's session on a client computer?

[QCH]

Remote Assistance....

[phuschnickens]

Remote Assistance....

p.s. without permission

[QCH]

VNC...

[phuschnickens]

anything built into a windows domain?

[QCH]

Not really.... there are ways to use SMS and some registry hacks to allow remote control without consent.

The bigger issue... Ethics. As a Domain Admin, I stay far away from these types of issues since we have so much power and many people are very leery of what we can do. Many assume we can do more than we can. I strive to let my users know that I would NEVER stoop to the level where I would eavesdrop on their computing without permission from upper management or some court order.

[phuschnickens]

Not really.... there are ways to use SMS and some registry hacks to allow remote control without consent.

The bigger issue... Ethics. As a Domain Admin, I stay far away from these types of issues since we have so much power and many people are very leery of what we can do. Many assume we can do more than we can. I strive to let my users know that I would NEVER stoop to the level where I would eavesdrop on their computing without permission from upper management or some court order.

Yeah I've thought of that. And then there's the other end... the "you're getting paid to work here not to come in on sundays just to use our internet access and although you say you're actually working on sundays it's clear that you can't really make sales calls on sundays because most businesses aren't open" side of it. and i also suspect she allows her 13 yo daughter to log on to another client computer to "play." I work in a small company for my father. We monitor emails and have recently implemented software that allows for call logging etc. It might make the company a little big brotherish which i'm not necessarily a fan of, but the paychecks come on time and we let them employees know that it's all just part of the deal.

I'm actually interested in feedback on this..

[QCH]

Logs are friend... Start adding logs to monitor activity. If you have a Microsoft Shop and run DNS, DHCP, and AD, then you should have enough logs to track down a ton of info with the right filters in place. Logs are good enough to get them fired. ;)

[phuschnickens]

k i'll look into it