[Previous] [Next]

Lesson 1: Configuring Account Policies

In Chapter 10, "Setting Up and Managing User Accounts," you learned about
assigning user account passwords and how to unlock an account that was locked by the system. In this lesson, you will learn how to improve the security of your users' passwords and how to control when the system locks out a user account.

After this lesson, you will be able to

• Configure Account Policies

Estimated lesson time: 35 minutes

Configuring Password Policy

Password Policy allows you to improve security on your computer by controlling how passwords are created and managed. You can specify the maximum length of time a password can be used before the user must change it. Changing passwords decreases the chances of an unauthorized person breaking into your computer. If a hacker has discovered a user account and password combination for your computer, forcing users to change their passwords regularly will cause
the user account and password combination to fail and lock the hacker out of
the system.

Other settings are available in Password Policy that you can use to improve your computer's security. For example, you can specify a minimum password length. The longer the password, the more difficult it is to discover. Another example is to maintain a history of the passwords used. This prevents a user from having two passwords and alternating between them.

You can configure Password Policy on a computer running Windows 2000 Professional by using Group Policy or Local Security Policy. You use Group Policy to configure Password Policy as follows:

1. Use MMC to create a custom console, add the Group Policy snap-in, and save it with the name Group Policy. (For more information on using MMC to create custom consoles, see Chapter 3, "Using Microsoft Management Console and Task Scheduler.")
2. Expand Local Computer Policy, under Computer Configuration expand Windows Settings, expand Security Settings, expand Account Policies, and then click on Password Policy.
3. Select the setting you want to configure, and then, on the Action menu, click Security.

The console displays the current Password Policy settings in the details pane, as shown in Figure 17.1.

Figure 17.1 Current Password Policy settings using Group Policy

Table 17.1 explains the settings available in Password Policy.

Table 17.1 Password Policy Settings

The Local Security Policy Setting dialog box appears for the selected policy.
Figure 17.2 shows the Local Security Policy Setting dialog box for the Maximum Password Age policy.

By carefully planning and configuring your Password Policy options, you can improve the security of your computer by decreasing the chances of an unauthorized user gaining access to it.

Configuring Account Lockout Policy

The Account Lockout Policy settings also allow you to improve the security on your computer. If no account lockout policy is in place, an unauthorized user can repeatedly try to break into your computer. If, however, you have set an account lockout policy, the system will lock out the user account under the conditions you specify in Account Lockout Policy.

Figure 17.2 The Local Security Policy Setting dialog box for the Maximum Password Age policy

You access Account Lockout Policy using either the Group Policy snap-in or
the Local Security Settings window, just as you did to configure Password Policy. The Group Policy console displaying the current Account Lockout Policy settings in the details pane is shown in Figure 17.3.

Figure 17.3 Current Account Lockout Policy settings using Group Policy

Table 17.2 explains the settings available in Account Lockout Policy.

Table 17.2 Account Lockout Policy Settings

Practice: Configuring Account Policies

In this practice, you will configure the account policies for your computer and then test your Account Policy to make sure it is correctly configured.

Exercise 1: Configuring Minimum Password Length

In this exercise, you will configure a Password Policy setting, Minimum Password Length, for your computer. Then you will test the password length you
configured to confirm that it was set.

1. Log on to your computer as Administrator.
2. Use MMC to create a custom console containing the Group Policy snap-in.
3. In the Group Policy console, expand Local Group Policy, expand Computer Configuration, expand Windows Settings, expand Security Settings, and then expand Account Policies.
4. Click Password Policy in the console tree.
5. In the details pane, right-click Minimum Password Length and then click Security.
6. Type 6 in the Characters box, and then click OK.
7. Close the Local Computer Policy custom console, and save the custom console as Group Policy.

1. Press Ctrl+Alt+Delete, and in the Windows Security dialog box, click Change Password.
2. In the Old Password box, type password and type water in the New Password and Confirm New Password boxes.
3. Click OK.

A Change Password message box appears indicating that your new password must be at least six characters long. So the Minimum Password Length setting in Password Policy is working.

4. Click OK, and then click Cancel.
5. Click Cancel to close the Windows Security dialog box.

In this exercise, you will configure and test additional Account Policies settings.

1. Use the Group Policy console to configure the following Account Policies settings:


• A user should have at least 5 different passwords before he or she accesses a previously used password.
• After changing a password, a user must wait 24 hours before changing it again.
• A user should change his or her password every three weeks.




Which settings did you use for each of the three listed items?

Answer

2. Close the Group Policy console and save the settings.

1. Log on as User4 with a password of User4.

NOTE

---

If you get a Logon Message dialog box indicating that your password will expire in a specified number of days and asking whether you want to change it now, click No.

1. Change your password to waters.

Were you successful? Why or why not?

Answer

2. Change your password to papers.

Were you successful? Why or why not?

Answer

3. Close all windows and log off.

In this exercise, you will configure the Account Lockout Policy settings, and then you will test them to make sure they're set up correctly.

1. Log on to your computer as Administrator.
2. Click Start, point to Programs, point to Administrative Tools, and then click Group Policy.
3. In the Group Policy console tree, if necessary, double-click Local Computer Policy, then Computer Configuration, then Windows Settings, then Security Settings, and then Account Policies.
4. Click Account Lockout Policy.
5. Use Account Lockout Policy settings to do the following:


• Lock out a user account after four failed logon attempts.
• Lock out user accounts until the administrator unlocks the user account.




Which Account Lockout Policy settings did you use for each of the two
conditions?

Answer

6. Close the Group Policy console, save changed settings, and log off as Administrator.

1. Try to log on as User4 with a password of papers. Try this four times.
2. Try to log on as User4 with a password of papers.

A message box appears, indicating that the account is locked out.

3. Click OK and then log on as Administrator.

In this lesson, you learned that the Windows 2000 Local Security Settings window allows you to improve the security on your computer by making it more difficult for an unauthorized user to gain access. Using the Password Policy settings is one method you can use to improve the security on your computer. Setting Password Policy allows you to manage the passwords used on your computer. For example, Password Policy includes settings that allow you to force users to change their passwords regularly and to control the minimum length of a password.

You also learned about another method of improving security on your computer: using Account Lockout Policy. If no Account Lockout Policy settings are in place, an unauthorized user can repeatedly try to break into your computer. Using Account Lockout Policy, you can determine the number of invalid logon attempts it takes before a user account is locked out of the computer. Account Lockout Policy also allows you to determine how long the account will be locked out; you can even set Account Lockout Policy to require that an administrator manually unlock the user account. In the practice portion of the lesson, you set and tested various account settings.