Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

There is a setting in active directory password to turn on or off "reversible encryption". Currently I have this feature turned on, and I am planning to turn it off. What effect will this have on the existing accounts? Will they no longer be able to log in? Will they be forced to change their password on next login? What should I expect?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Nothing immediate will happen. The reversible password is stored separately from the normal password so the passwords will keep working.

I think starting with Windows 2008, if you disable this option then the domain controllers will wipe out the reversible passwords for all affected users. Prior to Windows 2008 the password would stick around until the user changes their password, at which time the reversible copy is deleted.

share|improve this answer
    
Just to be clear with Win2k8, if the domain controllers wipe out the reversible passwords, I'm assuming I will need to assign new passwords to everyone, since AD will no longer be able to authenticate users? –  Barthalameu James Simpson Jun 24 '13 at 17:12
    
No. Re-read my second sentence. Then you enable reversible encryption you aren't changing the way the password is stored; your password is stored a second time in a separate field. So deleting the reversible password does not effect the normal password. –  longneck Jun 24 '13 at 17:28
    
Okay, I understand, thank you. –  Barthalameu James Simpson Jun 24 '13 at 18:28

The passwords will continue to be stored using reversible encryption until that password is updated. All users will be able to log in.

What you should do is to change this setting and then expire everyone's passwords, so that they must change them, and thus have a non-reversible hash stored.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.