0

I've had the following problems on multiple Windows networks (using domains) which have a password expiration policy:

After a while the user can't access network resources. This seems to be caused by the fact that the users password has expired, however s/he isn't notified about the fact that the password expired, even after multiple logins/logouts/reboots. Manually changing the password always resolves the issue. The machines are running up-to-date Windows XP. An other commonality seems to be that the given machines are rebooted rarely (once or twice a week).

While it is good to have a workaround, I would be interested in eliminating the source of the problem. Does anyone know what might be the root cause of this?

PS. A problem, which might or might not be related, is that some shares are only available when using their IP rather than their name...

Improve this question
3
  • For the password expiration to be notify check your group policies. Computer Configuration->Windows Settings->Security Settings->Local Policies->Security Options, 'Interactive Logon: Prompt User to Change Password'. You can define here how many days warning should it appear in advance to your users.
    – Nicolas Marengo
    Aug 27, 2009 at 10:57
  • I've checked the given setting and it is set to 14 days. And it seem to work, since the prompt appeared the last couple of times. This is why I thought that the password is not expired (this, and the fact fact that it could be used to authenticate locally). Is it possible for the password to expire without the notification to appear and for the local login still to work?
    – Grey Panther
    Aug 27, 2009 at 12:56
  • Sorry been busy, im not sure about your question. But if your computer cant talk to the domain controller then you might want to check your policies for cached profiles. For example, if you unplug your computer for the network it will still let you log in without having to contact the dc (if you have it set up that way), not sure what happens when the password has been expired for a while...
    – Nicolas Marengo
    Aug 28, 2009 at 14:43

1 Answer 1

Reset to default
1

"some shares are only available when using their IP rather than their name" - The shares not working, have you tried if the computer can resolve the name just doing ping "name" from cmd?

Also, the ones that ARE working, maybe because they might be on the computer's host file?

When the computer cant access network resources, try running a program called kerbtray. It will show the computer's kerberos tickets and you will be able to see if the computer lost connection with the domain controller.

Improve this answer
2
  • Thanks for the tip regarding the Kerbtray program, I'll start using it and the next time I observe the problem I will look at it. The Kerberos tickets expiring sounds like a good reason why the computer can't access resources anymore. However, shouldn't these tickets be renewed after logout/login or after a restart? Also, shouldn't these tickets be renewed when they expire (ie. if the computer has been running for long) or the connection with the DC is lost and the re-established?
    – Grey Panther
    Aug 27, 2009 at 9:20
  • They do renew automatically, unless the computer cant authenticate to the DC, if it cant then you wont be able to use the DNS server hence why you need to type the IP address instead. All this proves is if when the password expires the computer is or not able to authenticate to the DC.
    – Nicolas Marengo
    Aug 27, 2009 at 10:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .