3

I have the local security policy set to require a minimum password length of 10 characters. On a computer that is not part of a domain, and using the local admin account:

Scenario 1: If a user is created via Control Panel -> Administrative Tools -> Computer Management -> Local Users and Groups with a blank password, the system complains and prevents the account from being created.

Scenario 2: If a user is created via Control Panel -> User Accounts with a blank password, the system allows the account to be created with no problems (with admin rights). You can then log on to the system, with the blank password, but are forced to change it.

Why is the system allowing the account to be created with a blank password in the second scenario? How can it be prevented (policy, registry hack, etc)?

Thanks

Improve this question

3 Answers 3

Reset to default
1

I think you can deny access to the User Accounts Applet via GPO or Local Policy. At least in that way you can be sure that the vector you are aware of cannot be taken advantage of.

Improve this answer
1
  • +1. This is probably the way to go, because it fixes the problem, and the only other method of creating user accounts prevents the problem from occurring. Goodness only know why it happens... but if you can stop it from being an issue, don't waste your time trying to figure it out :)
    – SilentW
    Aug 30, 2010 at 17:14
0

Are you sure the policy applies? RSOP should allow you to see exactly what is managing the policy and how it applies

Improve this answer
1
  • I am pretty sure that settings are being applied. Try it, on a machine that is not part of a domain, and you'll see it works. I thought that the Resultant Set of Policy only works on a computer that is part of a domain.
    – Mike
    Jul 13, 2010 at 15:47
0

I think the policy against blank passwords only applies to users changing their own passwords. One way to ensure that newly created accounts don't fall victim to this would be to look at the password complexity rules and turn these on too.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .