Security

Ask something
Discussion Locked

Password Policy gone wrong? Help!

0 helpful
7 replies

by sarahb 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have recently implemented a password policy at my company using passflt.dll (minimum of 8 chars, has to contain mixed characters). A few people complained at having to change their passwords every 90 days, but hey, they always moan about something. But I have had the odd person who leaves their machine, locks it down, and then comes back and when they try to unlock it it says the password is incorrect. I thought this was user error but it is happening to gradually more people throughout the day. I tried changing the person's password in User Manager, but it still said wrong password. Is there anybody who knows why this might be happening? Please!? (NT4 Servers and NT4 / Win2k workstations)

7 replies

by dougbehrends

Might be one of two items.
1) they are using a screen saver that is not using the NT password
2) theya re logging on to the workstation rather than into the domain.

Hope this helps.

by dcraun

Until you find the solution, create a Domain Admin account that you can use to over-ride the locked machines. And in the mean time, don't allow screen saver passwords either. I would agree with above reply, make each user log into the domain, not just local work station.

by sarahb

They are logging into the domain. And there are no screensavers. But thanks for the replies anyway!

by g.farella

There was a problem where a nt ws user would get the password expiration-in-n-days warning, they'd click ok to change it, but then cancel before changing it. Then if they locked the nt ws down, or a password protected screen saver kicked in, the wscould only be unlocked by a different, admin account. I think it was fixed in sp4 or sp3.

by sarahb

Thanks for all your comments, but I think I have solved it. It seemed that a lot of (or all of) these passwords had the " or @ in them. Some keyboards are set to a US layout until the person has logged on. So my theory is if they changed their password when they were already logged on (with a UK profile) and then logged off and logged on again (at this stage it would have the default profile? - US?), the keyboard would have a different layout. Also our domain controller has a US keyboard layout so when I changed some of them on here when I thought I had typed the @, I had really typed ". Does this make sense!? I think this is what is happening. Just can't figure out how to change the default keyboard layout (before anyone has loggedon) to UK. Any ideas?

This discussion is closed to new replies.