Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there an ADUC setting that can prevent certain user accounts from locking out, particularly after x number of failed logon attempts? Oh and our DC is on Server 2003 at the moment, but we also use Server 2008 DC's in other environments.

share|improve this question

migrated from stackoverflow.com Mar 15 '11 at 22:41

This question came from our site for professional and enthusiast programmers.

4 Answers 4

up vote 1 down vote accepted

You can do it but you still need a GPO. Create a GPO that has the necessary settings, then eliminate the "apply group policy" right from the ACL. Create a group that you want to have eliminated from password lockouts, add your user(s) to the group, and assign that group the "apply group policy" right for your GPO.

Remember that GPOs are applied in the following order:

Local Site Domain OU

so be sure to apply your new GPO at the correct level so it's not stomped on by something below it.

share|improve this answer
    
Yup. It seems like this is the way to go (we tried it and it worked). –  Bob Mar 16 '11 at 13:59

A preferred approach would be to move off of your Windows Server 2003 DC's and configure your domain for Windows 2008 functional level, you will be able to take advantage of one of the new features of Windows Server 2008: multiple password and account lockout policies.

AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide
http://technet.microsoft.com/en-us/library/cc770842%28v=ws.10%29.aspx

How to raise Active Directory domain and forest functional levels
http://support.microsoft.com/kb/322692

share|improve this answer
    
cool. good to know. I think the DC is one of about 2% of machines in the domain still on 2003. :) It'll be upgraded someday (right?) –  Bob Mar 16 '11 at 14:03

I can't help but wonder why you don't simply allow blank passwords for those accounts. It's near enough the same (lack of a) security level as allowing unlimited attempts. Alternatively, you can either apply a separate GPO to those accounts that allows the maximum number of password attempts (whatever that number might be) or simply set as short a lockout time period as possible so that the account unlocks quickly enough that they don't really notice.

Of course the ideal solution would be to get these people to actually remember their passwords but I'm guessing these are senior managers.

share|improve this answer
    
rolls eyes And why is it that you always seem to be resetting the passwords for the same users, week in, week out. –  Mark Henderson Mar 16 '11 at 0:23
    
@Mark, I think there must be an oxygen shortage near the top of the corporate ladder. ;) –  John Gardeniers Mar 16 '11 at 1:30
    
These aren't senior managers. These are service accounts in a testing environment. They need real passwords to simulate production functionality, but they are constantly being pounded by devs trying stuff out. The domain itself cant have a GPO without proper security because the rest of our real accounts are in there. –  Bob Mar 16 '11 at 14:01
    
@Bob, you no doubt have a policy applying to the OU these accounts are in but by using filtering you can still have a different (or additional) policy apply to specific accounts. –  John Gardeniers Mar 16 '11 at 18:56
    
In practice there is a large difference in security between unlimited tries (you have logging and intrusion detection to flag this, right?) and no password at all. Also, the problem is more than just dumb users not knowing their password - You can miss one key by accident, and a misbehaving client or service will automatically try it a few times, just to be sure. I've seen accounts lock after only 3 tries, which is just ridiculous. –  CrazyPyro Oct 17 at 1:09

You should ask this on serverfault.com, although a quick answer is http://technet.microsoft.com/en-us/library/cc781491(WS.10).aspx

share|improve this answer
    
I appreciate the suggestion to move to Server Fault. Your link, however, is for computer and domain objects, not users. Further, Creating a GPO for the user with its own lockout rules is an option, but I am looking for a way to do this on individual accounts, effectively overriding a GPO. –  Bob Mar 15 '11 at 19:46
1  
You can't do it at an account level, you'd have to put the users in a group and then apply the policy to that group. –  dotalchemy Mar 15 '11 at 20:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.