Hello George,
Thank you for using newsgroup!
Based on my research, by default, Account Policies (Password, Lockout, and
Kerberos settings) are all defined in the Default Domain GPO. Since Domain
Controllers are responsible for enforcing these domain-wide policies,
Domain Controllers always receive these settings from the Default Domain
GPO. Furthermore, since Password and Lockout Policies are defined in the
Default Domain GPO, all Windows 2000 machines in that domain obtain the
same password and lockout policies for their local Security Accounts
Manager (SAM) database even though they have their own default local
account policies defined. This happens because domain-level policies have
precedence over local policies. Note that it is possible to specify a
different local password policy on workstations or servers by including
those workstations or servers in an OU which has its own account policy
settings. This is because an OU policy has precedence over a domain policy.
Security Settings in Windows 2000
<
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/gp/615.asp
Based on the description above, the domain Password policy will be
inherited to the workstations.
You may use GPResult or RSOP to verify if the domain Password policy has
been inherited.
To run gpresult:
1. Click Start->Run...->gpresult /z >c:\gpresult.txt
2. Send c:\gpresult.txt to me.
To run RSOP:
1. Click Start, click Run, type rsop.msc, and click OK.
2. The "Resultant Set of Policy is being processed" will appear.
3. After few minutes, you will see "Resultant Set of Policy".
Hope the information helps!
Thanks & Regards,
Ken Zhao
Microsoft Online Partner Support
Get Secure! -
www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| Thread-Topic: Local Admin. Password
| thread-index: AcX6q6ms75g7RbYYSRWAnWC7pD70RQ==
| X-WBNR-Posting-Host: 209.244.152.162
| From: "=?Utf-8?B?R2VvcmdlIFNjaG5laWRlcg==?="
<
[email protected]>
| References: <
[email protected]>
| Subject: RE: Local Admin. Password
| Date: Tue, 6 Dec 2005 13:26:04 -0800
| Lines: 15
| Message-ID: <
[email protected]>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
| Newsgroups: microsoft.public.win2000.general
| NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
| Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGXA03.phx.gbl
| Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.win2000.general:194473
| X-Tomcat-NG: microsoft.public.win2000.general
|
| I undid all GPO's relating to passwords and waited for replication. I
then
| chnaged the password to what I needed it to. When i reenable GPO's wil
this
| password expire ever? The local admin password never expires on the
other
| machines in my company.
|
| "George Schneider" wrote:
|
| > I recently rebuilt a windows 2000 pro machine. During install I left
the
| > local admin password blank. I tried chnaging it to what I have set all
the
| > local admin passwords to and I get an error stating it does not meet
the
| > complexity requiremnts. I guessing its grabbing this from the Domain
GPO
| > even though i'm logging on locally. I want to set this password to
what I
| > want and bypass this how can i do this.
| >
| >
|
