Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to set up a windows server 2008 in a virtual machine as demo system to show some apps which are only running on ws2008 with Active Directory.

Since this demo is run infrequently, first the one showing the system always needs to remember the logon password, and quite often is greeted with "your password has expired, pick a new one now" dialog.

Both is cumbersome, especially so since the VM is not connected to anything - how can I switch off the required password for windows server 2008 AD?

I changed the security in the AD group policy to no avail, and the local security policy is readonly, I can't change the values there.

share|improve this question
up vote 3 down vote accepted

The problem with the AutoAdminLogon solutions given by others is that the password still has to be supplied in the registry, and the password will still expire, even with it enabled.

So while doing what I am about to suggest is usually a Bad Idea™ under normal circumstances, in this particular case, being a demo domain controller, you will need to do both of the following to achieve what you are asking:

  1. Change the domain's password policy using Group Policy Management (gpmc.msc)

    • Enforce password history: 0 passwords remembered
    • Maximum password age: 0 days
    • Minimum password age: 0 days
    • Minimum password length: 0 characters
    • Passwords must meet complexity requirements: Disabled
  2. Change the Administrator user's account in Active Directory Users and Computers (dsa.msc)

    • Password never expires: check

After changing the settings noted above, you should be able to change the password of the Administrator to a blank password, and it should not expire (unless there is some other policy (perhaps at a Forest level) that overrides the change (if so, you can use the Resultant Set of Policy console (rsop.msc) to find where the policy is being set.

share|improve this answer
Ah yes, finally the right place - I had changed this somewhere else in the GP and was wondering why it did not work. Thanks! – Sam Sep 2 '09 at 7:40

There is an option for expiring passwords in the user "profile" options in Local Users of MMC. Let me find a screen shot.

share|improve this answer
Nice - problem is, there is no "local users and groups" in the computer Management, probably since the server is set up as primary Domain Controller in an Active Directory (see question). I can find the switch in the AD User Directory, but I want to get rid of the password, totally, to be able to start the VM without needing a password. – Sam Sep 1 '09 at 14:20
Why not augment this with Autologin. – Daniel A. White Sep 1 '09 at 14:51
if your using a domain account to login, then you have to check the password never expires via active directory users and computers – Nick Kavadias Sep 1 '09 at 15:00
  1. Start -> Run and enter "control userpasswords2" without quotes.
  2. Clear the checkbox for "Users must enter a user name and password to use this computer". Click OK.
  3. Enter the user name and password that will be used for Autologon. Click OK.

if you do not see the checkbox in step 2

  1. Start -> Run and enter

    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d "1" /f

Let me know if this works for you.


share|improve this answer
The userpasswords2 control panel is not available on domain controllers. That said, you can set the username and password in the same Winlogon registry key as the AutoAdminLogon value, by also creating / setting the DefaultUsername and DefaultPassword values. – Jessica McKinnon Sep 1 '09 at 15:44
according to the site I sourced the information from, it does work on DC's. – Keith Sep 1 '09 at 16:59
That site specifically refers to member servers and member workstations, and not domain controllers. – Jessica McKinnon Sep 1 '09 at 18:10
the author of the article mentions it works on DC's in the comments section. 5th comment. – Keith Sep 1 '09 at 18:56
the "control userpasswords2" is there, but there is no checkbox "Users must enter..." in there. Seems this thing is different on my WS2008 DC. – Sam Sep 2 '09 at 7:39

protected by sysadmin1138 Sep 28 '11 at 12:10

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.