Disable machine account password

[Miha]

Hi

In our company we have Win2003 DC Enterprise Server and WinXP Pro Clients.
Due to the policy, we installed 'radix' cards into public PC, so that system
is automatically restored into previous state when computers are restarted.
Everything worked OK, but after 30 days, users coulnd't log into the domain,
saying that domain is not available, and the only way was to re-join
computers to a new domain (put them to workgroup, and then back to domain.)
Looking what could casue this, we found that actually DC after 30 days
changes some SID of computer (macine account) and because of this when
computer was restored back to 'basic' settings this problem appeard.

So I created a domain policy for this computers and under
- Computer Configuration\Windows Settings\Security Settings\Local
Policies\Security Options and set option under 'Domain Members: Disable
machine account password changes to ENABLED.

When I checked local policy settings at client computers, I noticed that
this setting was set to ENABLED, but setting under 'Domain Member: Maximum
machine account password age' was set to 30 days. I checked this at my
domain policy, and noticed that I can only set this to 999 days, but as I
see, if the previous setting was set to ENABLED, this setting doesn't apply,
or am I wrong?
I just want to be certain, that this will solve our problem, so that we
don't have to re-join computers to a domain after another 30 days

Thank you all in advance for help
Best regards
Miha

 

[Chris M]

In our company we have Win2003 DC Enterprise Server and WinXP Pro Clients.
Due to the policy, we installed 'radix' cards into public PC, so that
system is automatically restored into previous state when computers are
restarted.
Everything worked OK, but after 30 days, users coulnd't log into the
domain, <SNIP>

I work at a University, and we use Radix Protector Net cards in a few of our
labs. For some reason we didn't have this problem, even though we were
expecting to see the behaviour you describe.

Anyway, that aside, we also found that the number of machine failures (i.e.
requiring the machine to be re-ghosted) were huge in the labs with protector
cards compared to the ones without. Not to mention the hassle of getting
these machines to update from a SUS server, and getting the labs into
installation mode whenever we need to update anything else.

Consequently we are not buying cards for the new machines we are buying in.

Just my 2p worth...

 

[Jerold Schulman]

Hi

In our company we have Win2003 DC Enterprise Server and WinXP Pro Clients.
Due to the policy, we installed 'radix' cards into public PC, so that system
is automatically restored into previous state when computers are restarted.
Everything worked OK, but after 30 days, users coulnd't log into the domain,
saying that domain is not available, and the only way was to re-join
computers to a new domain (put them to workgroup, and then back to domain.)
Looking what could casue this, we found that actually DC after 30 days
changes some SID of computer (macine account) and because of this when
computer was restored back to 'basic' settings this problem appeard.

So I created a domain policy for this computers and under
- Computer Configuration\Windows Settings\Security Settings\Local
Policies\Security Options and set option under 'Domain Members: Disable
machine account password changes to ENABLED.

When I checked local policy settings at client computers, I noticed that
this setting was set to ENABLED, but setting under 'Domain Member: Maximum
machine account password age' was set to 30 days. I checked this at my
domain policy, and noticed that I can only set this to 999 days, but as I
see, if the previous setting was set to ENABLED, this setting doesn't apply,
or am I wrong?
I just want to be certain, that this will solve our problem, so that we
don't have to re-join computers to a domain after another 30 days

Thank you all in advance for help
Best regards
Miha

See tip 3607 and links in the 'Tips & Tricks' at http://www.jsifaq.com

 

[Kelly]

Hi Jerold,

Long time no see. )

--

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

 

[Jerold Schulman]

Hi Jerold,

Long time no see. )

I slowed down a little, but not that much

 

[Kelly]

Thanks for the reply, Jerold and I hear you! )

--

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com