Networks

Ask something
Question Locked

Hack - Set the "last password changed date" on Win2k Server

0 helpful
5 replies

by dducke

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

In Win2k when a user changes his / her password of a local user account, this date is recorded. Does anyone know how to change this date (to a specific date) without actually having to change the password?

This is not for malicious reasons. It is for some security software I am playing/developing. Not like anyone will believe me, but...

To summarise: I want to set the last password changed date on a Windows 2000 Server to any specific date I want to.

Thanx
Dave

Your help would be most appreciated.

5 replies

by Former member

By default, Windows will notify users 14 days before their password expires. You can change the 14 day value and increase or decrease it, depending on your requirements. This can easily be accomplished by editing the appropriate GPO or the local computer policy. You can change the default value in Windows XP using the steps below:

1. Click Start and click Run.
2. Type gpedit.msc and click OK.
3. Expand the following: Computer Configuration | Windows Settings | Local Policies | Security Options.
4. In the right pane, double click Interactive logon: Prompt user to change password before expiration.
5. Configure the value you want to use, click Apply, and click OK.
6. Close the Group Policy Editor.

If you are using Windows 2000, you will be looking for the Prompt user to change password before expiration setting under the Local Policies container.

Please post back if you have any more problems or questions.
If this information is useful, please mark as helpful. Thanks.

by dducke

Yes, I know that about windows. My request is a bit more related to the hacker.

here's the scenario. A server administrator has logged onto a server and managed to change a password and reset the password change date to an older date. There is no trace of this change in the event logs or anywhere else.

What I want to do is find out how is this achieved and then find security measures around it.

Changing the password is fine. It is just the part about resetting the date, i.e. they managed to edit the SAM while the server is running. How?

by Former member

Before i let you know HOWTO.
Please answer the above question.
If you do not then you will have to ask your computer man of whom has this ability to reset the password and dates. :)

Please post back if you have any more problems or questions.
If this information is useful, please mark as helpful. Thanks.

by dducke

Yes, I have full Admin rights on the server and on the domain and I am a sys. admin.

This discussion is closed to new replies.