djc said:
I just had a user lock out a local admin account?
this is new? I did not think local administrator accounts were subject to
GPOs such as the account lockout thresholds etc.. I didn't think the local
administrator account *could* be locked out by too many failed login
attempts? when did this change?
You are right, but it is possible to change this behaviour using the
passprop.exe tool provided in the Windows Resource Kit. Maybe the user, or
someone, did that?
I think that the "account locked" checkbox still gets checked after too many
failed login attempts but it has no effect.
From:
http://www.microsoft.com/technet/security/topics/serversecurity/administratoraccounts/aapgch03.mspx :
-------------------------
Enable Account Lockout for Remote Administrator Logons
One way to prevent attackers from using the built-in administrator account
and password credentials is to allow the administrator account to be locked
out of the network by an account policy, after a specified number of logon
failures occur. By default, the built-in administrator account cannot be
locked out; however, you can use passprop.exe, a command-line program in the
Microsoft Windows 2000 Server Resource Kit, to enable account lockout for
remote logons that use the administrator account. When you run the passprop
utility with the /ADMINLOCKOUT switch, you make the administrator account
subject to account lockout policies. In Windows 2000 Server, this only
applies to remote logons, and because the built-in administrator account can
never be locked out from the local computer, this program allows you to
protect the administrator account from attack over the network but still
allows interactive access.
Warning: In Windows Server 2003, passprop will allow the built-in
administrator account to get locked out from interactive logons as well as
remote logons.
You can use the following account lockout switches with passprop:
passprop [/adminlockout] [/noadminlockout]
The /adminlockout switch keeps the administrator locked out.
The /noadminlockout switch removes the administrator lock out.
Note: When you enable this setting, and the account becomes locked out, no
one can do any remote administration with the administrator account.
