Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We had a password expiration policy recently removed from our AD but some users continued to get the "..your password will expire in x days. would you like to change it now?" message.

So we added a reverse/undo policy to correct the local registry settings

Maximum password age = 0 days
Minimum password age = 0 days

This hasn't worked as new users still seem to encounter the above "change password" message sporadically. We have now removed all custom password policy GPOs and are left with the "Default Domain Policy". Still no good.

Can someone point me in the direction to fix this? And an explanation into what i was doing wrong (/how password expiration policies apply) would be useful too. thanks

Environment is 2k3 server with mostly XPsp2 clients.

share|improve this question
    
why do you want to remove it? You can disable it for certain accounts but wouldn't disable it for everyone. –  onesysadmin Jan 23 '10 at 10:18
    
@Roy: I'd be happy it going back to the way it was before i added any expiration policy (ie. "Default Domain Policy" GPO w/no password expiry settings specified). Why? - i don't want passwords to expire atm. –  cottsak Jan 23 '10 at 11:41

2 Answers 2

up vote 1 down vote accepted

I can't remember exactly, but from memory, If the user account has already expired they are marked in the AD db as such and need to be reset anyway even if you remove the policy afterwards.

share|improve this answer
    
I thought this might be the case. Can u link to doco? –  cottsak Jan 24 '10 at 5:18
    
No idea on documentation, IIRC I heard about it in class. –  p858snake Jan 24 '10 at 6:02
    
Ok. thanks. this seems likely to me. perhaps a flag i can access with ASDI Edit. –  cottsak Jan 24 '10 at 11:07
    
I didn't try to hack this manually. I just asked the affected minority group of users to manually rotate. Seems to have fixed it. –  cottsak Mar 30 '10 at 4:46
    
0x00800000 ADS_UF_PASSWORD_EXPIRED The user password has expired. This flag is created by the system using data from the Pwd-Last-Set attribute and the domain policy. If the password has already expired, this value in UserAccountControl will be turned on. Adding this reference for future use :D –  marty Nov 30 '11 at 0:32

You must create/apply a policy to the OU in which the users are stored with a specific policy that explicitly disables the password expiration.

share|improve this answer
    
As i mentioned we did that ("So we added a reverse/undo policy.."). No luck. –  cottsak Jan 23 '10 at 11:39
    
Did you check id any other policy override this one? –  lrosa Jan 23 '10 at 11:57
    
Yep. I used the Modelling wizard –  cottsak Jan 24 '10 at 5:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.