#36359 - 2003-02-12 01:04 AM
Re: Question on scripting passfilt for 2000
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
You only need to install passfilt.dll on the domain PDC where the accounts live, unless you are saying that you have local accounts on every server.
|
|
Top
|
|
|
|
|
#36360 - 2003-02-13 12:44 AM
Re: Question on scripting passfilt for 2000
|
New Mexico Mark
Hey THIS is FUN
Registered: 2002-01-03
Posts: 223
Loc: Columbia, SC
|
Hi MightyR1: I'll look into security templates, but it sounds like using a sledgehammer to swat a fly.
Howard: Unfortunately, since almost all the servers are stand-alone and not domain members, we have to deal with local accounts. These include administrator accounts, developer accounts, third-party business accounts, and sometimes even customer accounts.
Of course, we have a written password policy in place in the company, but limited legal means to enforce that policy to non-company employees. Again, it is the problem that 10 percent of the users generate 90 percent of our headaches.
Any other ideas while I'm looking at security templates?
Thanks,
Mark
|
|
Top
|
|
|
|
|
#36361 - 2003-02-12 01:12 PM
Re: Question on scripting passfilt for 2000
|
New Mexico Mark
Hey THIS is FUN
Registered: 2002-01-03
Posts: 223
Loc: Columbia, SC
|
I refreshed my memory on security templates at the Microsoft site. This *might* work on the security level, but then I'm still left with the problem of how to script implementing the template. I need to create an extremely reliable and extremely simple solution for this to work. (I.e., pop a diskette in each system and type a:\passfilt)
Part of what makes things so difficult in our environment is that (with the exception of our internal domain for users), these 400 systems are all isolated into about 35 groups with different local admin passwords, and even network isolation. The reason is because we are business partners with a lot of different companies, and we have contractual agreements to ensure their information and software is isolated from all other groups.
So our situation is the opposite of most networks, where servers may be physically located in different areas, but tied together in a single domain and/or Active Directory structure. Instead, this is like having to provide a simple solution to 35 different companies. And keep in mind that these companies are all running various home grown and third party apps on their systems. If we break their apps, we lose business. So every change must be tested extensively. This pretty much rules out a blanket security template approach.
Back to the original question... any ideas how I can activate password complexity requirements on stand-alone Windows 2000 servers via a script?
Thanks,
NMM
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
0 registered
and 2870 anonymous users online.
|
|
|
