Question

Locked

Group Policy Problem

By jason ·
About a month ago we created a group policy to force people to change their password once a month. Now it hac come arround to change our passwords, but every time we try we get a message saying it has to be 29 days old, can't repeat our last password and must be 6 characters long.

I am trying a password I have never used before, is 12 characters long, and it has been 29 days. So we went and changed the policy so that it was max age 30 days, min age 15 days, no minimum length and no remembered passwords. I then restarted my desktop, but when I try to change my password at login, it is giving the exact same message. At this point I am stuck. Any suggestions?

This conversation is currently closed to new comments.

2 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

Try this ....

How To Prevent Users from Changing a Password Except When Required in Windows Server 2003

SUMMARY
How to Configure the System to Prevent Users from Changing Passwords Unless Prompted
How to Configure a Site, Domain, or Organizational Unit to Prevent Users from Changing Passwords Unless Prompted
How to Disable the Change Password Option for One or More Specific Users
REFERENCES
SUMMARY
This step-by-step article describes how to prevent users from changing their passwords except when they are required to do so.

Centralized control of user passwords is a cornerstone of a well-crafted Windows security scheme. You can use Group Policy to set minimum and maximum password ages. A minimum password age prevents users from changing passwords too frequently. Frequent password changes can be used by users to circumvent a password-history setting. They may also lead to more calls to the help desk because of forgotten passwords.

How to Configure the System to Prevent Users from Changing Passwords Unless Prompted
Users can change their passwords during the period between the minimum and maximum password age settings. Your security design may require that users change their passwords only when they are prompted by the operating system at the maximum password age. You can configure Windows to permit users to change their passwords only when the operating system prompts them to do so. To prevent users from changing their passwords (except when required), disable the Change Password option in the Windows Security dialog box that appears when you press CTRL+ALT+DELETE.

You can implement this configuration for a whole domain by using a Group Policy, or you can implement this configuration for one or more specific users by editing the registry.

How to Configure a Site, Domain, or Organizational Unit to Prevent Users from Changing Passwords Unless Prompted
1. Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
2. Right-click the domain or organizational unit for which you want to implement the new password change policy, and then click Properties.
3. Click the Group Policy tab.
4. Click the Group Policy object (GPO) that you want to work with, and then click Edit. If there are no existing policies listed in the Group Policy Object Links list, click New to create a new policy, type a name for the new policy, and then click Edit.
5. Expand the GPO, expand User Configuration, expand Administrative Templates, and then expand System.
6. Click Ctrl+Alt+Del Options.
7. In the right pane, double-click Remove Change Password.
8. Click Enabled, and then click OK.
9. Quit the Group Policy Object Editor snap-in, click OK, and then quit the Active Directory Users and Computers snap-in.
10. Click Start, and then click Run.
11. Type cmd in the Open box, and then click OK.
12. At the command prompt, type the following line, and then press ENTER:
gpupdate /target:user /force
13. Type exit to close the command prompt.
NOTE: By default, policies that are applied to either users or computers at the domain level will apply to all users and all computers in the domain. By default, the application of a policy to organization units will apply to all user accounts and machine accounts that reside in that organization unit, and to any suborganizational unit that may exist. A user account must either be moved into, or be created in, that organization unit for it to apply. If you just add security groups that a user may be a member of to an organization unit, this will not apply the policy to that user.

How to Disable the Change Password Option for One or More Specific Users
The following procedure must be performed on the user's computer.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 (http://support.microsoft.com/kb/322756/) How to back up and restore the registry in Windows

1. Click Start, and then click Run.
2. Type regedit in the Open box, and then click OK.
3. Locate the following registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies
4. Click the System subkey, if it exists. If the key does not exist, create it. To do this:
a. Click the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies key.
b. On the Edit menu, point to New, and then click Key.
c. Name the new key System. To do this, type System, and then press ENTER.
5. Click the System key that you created.
6. On the Edit menu, point to New, and then click DWORD Value.
7. Name the new value DisableChangePassword. To do this, type DisableChangePassword, and then press ENTER.
8. Double-click the DisableChangePassword value that you created. Type 1 in the Value data box, and then click OK.
9. Quit Registry Editor.
10. Press CTRL+ALT+DELETE, and then verify that the Change Password option is unavailable (appears dimmed) in the Windows Security dialog box that appears.


REFERENCES
For more information about working with Group Policy in Windows Server 2003, see Group Policy Help. To do this, click Help on the Action menu in the Group Policy Object Editor snap-in, click the Contents tab, and then click Group Policy.

APPLIES TO
? Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
? Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
? Microsoft Windows Server 2003, Standard Edition (32-bit x86)
? Microsoft Windows Server 2003, 64-Bit Datacenter Edition
? Microsoft Windows Server 2003, Enterprise x64 Edition
? Microsoft Windows Small Business Server 2003 Standard Edition
? Microsoft Windows Small Business Server 2003 Premium Edition

Until you get everything sorted you can try this, it does everything that you need and more.


http://searchwindowssecurity.techtarget.com/news/article/0,289142,sid45_gci1044698,00.html

http://www.spotmau.com/

Please post back if you have more problems or questions.

Back to Software Forum
2 total posts (Page 1 of 1)  

Related Discussions

Related Forums