Password Expiration Policy

[JBailey]

We currently do not enforce password expirations. We want to set this up so
all users (about 500) need to change their passwords on a specific day and
then have their passwords expire every 90 days. How do I set this up
correctly in the default domain policy?

Thanks,
JBailey

 

[Steven L Umbach]

I don't know of an easy way to force them all to change their passwords on a
certain day, unless you configure all their accounts to need to change their
password at next logon the night before the target day. Keep in mind that
any accounts configrured with password does not expire in account properties
will not be affected by domain password age policy. Be sure to give users
plenty of advance notice of impending change including the specifics of what
their new password must be like [length and complexity] including examples
and then give them notice again just before the change is to occur or you
will be swamped with calls from people saying that they can not change their
password. --- Steve

 

[JBailey]

We are planning on sending out notice, and all accounts have been checked to
make sure the does not expire setting is set correctly. Is there a utility
that will allow me to make the change password at next logon setting to
multiple accounts in a Windows 2000 domain?

Thanks,
JBailey

I don't know of an easy way to force them all to change their passwords on a
certain day, unless you configure all their accounts to need to change their
password at next logon the night before the target day. Keep in mind that
any accounts configrured with password does not expire in account properties
will not be affected by domain password age policy. Be sure to give users
plenty of advance notice of impending change including the specifics of what
their new password must be like [length and complexity] including examples
and then give them notice again just before the change is to occur or you
will be swamped with calls from people saying that they can not change their
password. --- Steve

We currently do not enforce password expirations. We want to set this up so
all users (about 500) need to change their passwords on a specific day and
then have their passwords expire every 90 days. How do I set this up
correctly in the default domain policy?

Thanks,
JBailey

 

[Steven L Umbach]

That would probably need to be scripted. Windows 2003 allows that to be done
in ADUC. See the links below for a couple possibilities. --- Steve

http://www.microsoft.com/technet/tr...echnet/scriptcenter/scrguide/sas_usr_akke.asp
http://tinyurl.com/2y92q -- same link as above, shorter.
http://www.jsiinc.com/SUBJ/tip4700/rh4755.htm

We are planning on sending out notice, and all accounts have been checked to
make sure the does not expire setting is set correctly. Is there a utility
that will allow me to make the change password at next logon setting to
multiple accounts in a Windows 2000 domain?

Thanks,
JBailey

I don't know of an easy way to force them all to change their passwords

on

a
certain day, unless you configure all their accounts to need to change their
password at next logon the night before the target day. Keep in mind that
any accounts configrured with password does not expire in account properties
will not be affected by domain password age policy. Be sure to give users
plenty of advance notice of impending change including the specifics of what
their new password must be like [length and complexity] including examples
and then give them notice again just before the change is to occur or you
will be swamped with calls from people saying that they can not change their
password. --- Steve

We currently do not enforce password expirations. We want to set this

up
so

all users (about 500) need to change their passwords on a specific day and
then have their passwords expire every 90 days. How do I set this up
correctly in the default domain policy?

Thanks,
JBailey

 

[JBailey]

I actually decided to go with Hyena.

Thanks for your help!

JBailey

That would probably need to be scripted. Windows 2003 allows that to be done
in ADUC. See the links below for a couple possibilities. --- Steve

http://www.microsoft.com/technet/tr...echnet/scriptcenter/scrguide/sas_usr_akke.asp
http://tinyurl.com/2y92q -- same link as above, shorter.
http://www.jsiinc.com/SUBJ/tip4700/rh4755.htm

We are planning on sending out notice, and all accounts have been

checked

to
make sure the does not expire setting is set correctly. Is there a utility
that will allow me to make the change password at next logon setting to
multiple accounts in a Windows 2000 domain?

Thanks,
JBailey

passwords

on

a
certain day, unless you configure all their accounts to need to change their
password at next logon the night before the target day. Keep in mind that
any accounts configrured with password does not expire in account properties
will not be affected by domain password age policy. Be sure to give users
plenty of advance notice of impending change including the specifics

of
what

their new password must be like [length and complexity] including examples
and then give them notice again just before the change is to occur or you
will be swamped with calls from people saying that they can not change their
password. --- Steve

We currently do not enforce password expirations. We want to set

this

up day
and