Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have noticed on my domain environment; the old Administrator password (before password expire).. The client machines have cached the old password and have the ability to bypass the new password by entering the old one..?

Basically; I'm running a UAC enabled domain, which needs the administrator password to continue basic stuff; installations and such. The password for the administrator account has been changed due to expiration of said accounts password. By accident a fellow administrator typed the old password and still bypassed the UAC with what should have been the incorrect password.

Is this a bug with the environment? or something that needs to be tweaked in the server sided settings?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

It's not entirely clear what your situation is, but I see two possibilities.

1. You have cached domain credentials

In this case, it's working as designed. Windows will remember the last X logins in th event that a machine needs to be accessed, but a domain controller is unavailable. I think it's five by default, but you can turn this feature off with a GPO.

It's under Computer Configuration --> Windows --> Settings --> Security Settings --> Local Policies --> Security Options and the policy is named Network Access: Do not allow storage of credentials or .NET Passports for network authentication. Enable it, and no more password caching.

Though, this will cause issues if you need to access a machine that's orphaned from the domain, so keep those local Administrator account passwords handy.

2. Your users are using the local Administrator account

Also working as designed - password expiration only applies to domain accounts, not local ones.

Fortunately, this can also be handled with GPOs. You'd want to disable or rename the local administrator account and change the password, which is also doable. The location of the various default GPOs for configuring the local administrator account are below.

In Group Policy Object Editor, click Computer Configuration, click Windows Settings, click Security Settings, click Local Policies, and then click Security Options.

I find it easiest to disable the Administrator account, with the GPO and deploy a new account with local permissions with GPP (Local Users and Groups under Computer Preferences, Control Panel), but the way you do it is up to you.

share|improve this answer
    
Basically; I'm running a UAC enabled domain, which needs the administrator password to continue basic stuff; installations and such. The password for the administrator account has been changed due to expiration of said accounts password. By accident a fellow administrator typed the old password and still bypassed the UAC with what should have been the incorrect password. ---- I will try this tomorrow when at the office; I will inform and make the necessary upvote + mark as question if resolved –  Daryl Gill Dec 14 '12 at 3:55
    
@DarylGill Might be worth editing that into your question, as well as anything else you learn tomorrow, especially if this doesn't resolve the issue. –  HopelessN00b Dec 14 '12 at 4:11
    
Problem resolved with the policy! –  Daryl Gill Dec 15 '12 at 0:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.