As well as "denied access" and even completely disabled!

t

----- Original Message -----
From: "Laura A. Robinson" <larobins (at) bellatlantic (dot) net [email concealed]>
To: "'Bates, Chris'" <Chris.Bates (at) nwdc (dot) net [email concealed]>; <focus-ms (at) securityfocus (dot) com [email concealed]>
Sent: Thursday, October 20, 2005 3:15 PM
Subject: RE: Account Lockout Policy

> Actually, the local admin account can be locked out (at least post-2000).
> Test it out. :-)
>
> Laura
>
>> -----Original Message-----
>> From: Bates, Chris [mailto:Chris.Bates (at) nwdc (dot) net [email concealed]]
>> Sent: Thursday, October 20, 2005 1:48 PM
>> To: focus-ms (at) securityfocus (dot) com [email concealed]
>> Subject: FW: Account Lockout Policy
>>
>> You can change the local policy on the machine, or filter a
>> GPO to only apply to that machine.
>> But if they are using the hardcoded local admin, it can't be
>> locked out.
>> MS Safety feature I guess.
>>
>>
>> ----------------------------------------------------------------------
>> Chris Bates (CISSP)
>> Infrastructure Management Consultant
>> ACS Inc. (Enterprise Services; NWDC)
>> Chris.Bates (at) nwdc (dot) net [email concealed]
>>
>>
>> -----Original Message-----
>> From: Derick Anderson [mailto:danderson (at) vikus (dot) com [email concealed]]
>> Sent: Thursday, October 20, 2005 8:59 AM
>> To: Shabbar Arsiwala; focus-ms (at) securityfocus (dot) com [email concealed]
>> Subject: RE: Account Lockout Policy
>>
>>
>>
>> > -----Original Message-----
>> > From: Shabbar Arsiwala [mailto:sarsiwala (at) obleness (dot) org [email concealed]]
>> > Sent: Thursday, October 20, 2005 9:07 AM
>> > To: focus-ms (at) securityfocus (dot) com [email concealed]
>> > Subject: Account Lockout Policy
>> >
>> > -----BEGIN PGP SIGNED MESSAGE-----
>> > Hash: SHA1
>> >
>> > We have an account lockout policy setup for users on our domain Win
>> > 2K3 / Active Directory environment. 4 invalid attempts the account
>> > locks out / 30 mins the account is released. We would like
>> to change
>> > this policy for one the machines on our domain. This machine uses a
>> > local administrator account to log in.
>> >
>> > Is this possible ???
>> >
>> > Thanks,
>> > Shabbar
>>
>> It is possible to change the *local* machine account lockout
>> policy for a specific machine, but not the *domain* lockout
>> policy. To do this you need to put your *domain* password
>> policy in the Domain Controllers OU, create a separate OU for
>> this one machine, make a new policy with the desired lockout
>> settings, and link it to the single machine's OU. This will
>> only work for *local* accounts (such as MACHINE\Administrator), not
>> *domain* accounts (DOMAIN\Administrator).
>>
>> Derick Anderson
>>
>> --------------------------------------------------------------
>> ----------
>> ---
>> --------------------------------------------------------------
>> ----------
>> ---
>>
>>
>>
>>
>> --------------------------------------------------------------
>> -------------
>> --------------------------------------------------------------
>> -------------
>>
>
>
> ------------------------------------------------------------------------
---
> ------------------------------------------------------------------------
---
>
>
>

------------------------------------------------------------------------
---
------------------------------------------------------------------------
---

[ reply ]