Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When a user on one of our Windows clients hits ctrl-alt-delete to change his password, our Samba domain controller is notified and performs the password change.

Unfortunately, the group policy rule requiring password complexity is ignored. Further, we recently began implementing kerberos, and samba isn't set up to update the principals.

I feel that the simplest way to fix this would be to disable password changes from our Windows clients on the domain (users can use our web services to change passwords instead).

What's the simplest way to implement this? Hopefully in the smb.conf.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

If you have a mechanism for updating the registry on the Windows Computers you can set the

DisableChangePassword
DWORD value to 1 in:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
System

and

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\
System

This will disable the change password button, in the Windows Security Dialog box.

share|improve this answer
    
Thanks. I'd pretty much convinced myself that this is impossible through samba (without totally disabling smbpasswd). I will give this a try for disabling it per-client. My other option seems to be, if I go the route of not disabling the password change function, is simply to set up smb.conf to call kadmin to change user passwords and continue to do an ldap sync as it does now. With the password program option, I can wrap a set of password rules around the kdmin call. This will involve rewriting our current password scripts that call smbpasswd and kpasswd to only call smbpasswd. –  thras Jun 25 '09 at 20:26

Depending upon your configuration,

enabling pam password change = no

May do the trick.

share|improve this answer

You could try to modify the parameters passwd program and passwd hat in smb.conf, setting it to /bin/false or something. Not sure that this will help though.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.