How to set account lockout policies in Windows 2000 and Windows Server 2003
In Microsoft Windows 2000 and in later versions of Windows, you can configure account lockout policies in the Active Directory directory service. To configure account lockout policies in Windows 2000, use the ADSI Edit snap-in to edit Active Directory and to change the PwdProperties attribute in the domain naming context. When you make this change on one domain controller, the change is replicated to all other domain controllers on your network.
Note If you want to set the administrator account lockout policy in a Microsoft Windows NT 4.0 environment, use the Passprop.exe utility from the Windows NT 4.0 Resource Kit.
- Install the ADSI snap-in if it is not already installed on your system. This snap-in is included in the Windows 2000 Support Tools.For additional information about how to install the Windows 2000 Support Tools, click the following article number to view the article in the Microsoft Knowledge Base:301423 How to install the Windows 2000 support tools to a Windows 2000 Server-based computer
Warning If you use the ADSI Edit snap-in, and you incorrectly modify the attributes of Active Directory objects, you may cause serious problems. These problems may require that you reinstall Windows 2000 Server, Microsoft Exchange 2000 Server, or both. We cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.
- Click Start, point to Programs, point to Windows 2000 Support Tools, point to Tools, and then click ADSI Edit.
- Expand Domain NC [Your_Domain_Name].
- Right-click DC=Your_Domain_Name,DC=Your_Domain_Name, and then click Properties.
- Click the Attributes tab, and then in the Select a property to view list, click pwdProperties.
- In the Edit Attribute box, type the value that you want to use. The following value options are available.
Value Password policy 0 Passwords can be simple, and the administrator account cannot be locked out. 1 Passwords must be complex, and the administrator account cannot be locked out. 8 Passwords can be simple, and the administrator account can be locked out. 9 Passwords must be complex, and the administrator account can be locked out.
- Click Set, click Apply, and then click OK.
- Quit the ADSI Edit snap-in.
Article ID: 885119 - Last Review: 10/30/2006 21:23:13 - Revision: 2.2
- kbhowto kbinfo KB885119