To get AD to never forget computer that was reimaged multiple times one has to refuse passwords that are changed at domain controller level. This article has all info necessary.
To do this, add the following registry value on all domain controllers: Key = HLM\SYSTEM\CurrentControlSet\Services\NetLogon\Parameters Value = RefusePasswordChange REG_DWORD 1 Default = 0
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
154501 How to disable automatic machine account password changes
Windows XP and later versions
In Windows XP and later versions, machine account password settings can also be configured by using Group Policy Editor (Gpedit.msc)
. To configure these settings, follow these steps:
- Click Start, click Run, type Gpedit.msc, and then press ENTER.
Expand Local Computer Policy
, expand Windows Settings
, expand Security Settings
, expand Local Policies
, expand Security Settings
, expand Local Policies
, and then expand Security Options
. Configure the following settings:
Domain Member: Disable machine account password changes (DisablePasswordChange)
- Domain Member: Maximum machine account password age (MaximumPasswordAge)
- Domain Controller: Refuse machine account password changes (RefusePasswordChange)
MaximumPasswordAge has a default value of 30. The Group Policy user interface allows for a maximum value of 999 days, and the component allows for a maximum of 1,000,000 days through the registry.