Default Domain Policy - Password Policies not always applying correctly

[Curtis Fray]

Hi,

We've had an on going problem that I'm hoping someone may be able to shed
some light on. I have a Windows 2003 domain which contains XP workstations.
All are up to date with service packs and security patches. The problem some
users occasionally get is they log on to Windows and then find they can't
access any data. What we then find is their password has actually expired
but they've not been prompted to enter a new one. Our helpdesk get around
this by logging in as themselves and running "gpupdate /force". When the
user then logs on they're prompted to change their password.

This doesn't happen to everyone. The pattern generally seems to be if it's a
user who's been away on holiday or off for a while, or using a computer that
hasn't been turned on in a while.

Has anyone got any ideas what could be causing this and how to get around
it?

Thank you,

Curtis.

 

[Harj]

Hi,

Look through this article as this could be the cause of the issue.

Description of the Windows XP Professional Fast Logon Optimization
feature
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q305293&SD=MSKB&

You state that they are prompted to change their password after a
gupdate /force is performed. This would tell me that the policy is
either not applying correctly (not true as a gpupdate /force works), or
the policy is not applying during the logon process (fast logon
optimization during logon)

Good luck

Harj Singh
Password Policy done Right
www.specopssoft.com

 

[Curtis Fray]

Hi Harj,

That looks promising. I'll do some tests. Thanks for finding that for me!

Regards,

Curtis.

--