Implications of changing "Maximum machine account password age" policy

[FN-GM]

Hello.

 

I have written a PowerShell script that will disable and delete old computers from Active Directory. The script uses the time period since the machine password was last changed. To get a more accurate result i am considering changing the Maximum machine account password age policy.

 

I have one question. If I change the policy from the default of 30 day to say 5. If a computer is turned off for 6 weeks and then is turned on will that machine loose the trust with the domain please?

 

All clients on the domain are running Windows 7 with Server 2008 R2.

 

Many Thanks

[Arthur]

Don't you mean 6 days? Either way, it's not recommended.

 

In some countries where workers get several weeks of vacation, it is not uncommon for a worker to take four weeks off at a stretch. (This could also be the situation in a job share arrangement.) When the worker comes back, the computer does not talk to the domain.

 

There are a couple of ways to handle this. One way is to increase the amount of time between the changes of the secure channel password (but I do not recommend this). Another way is to remove the computer from the domain, reboot the computer, join the computer to the domain, and reboot again. On my laptop (where it takes nearly 10 minutes for the laptop to become usable after a reboot), we are talking about a 30 minute process.

 

There are other alternatives to this multiple reboot scenario. Each of these solutions could easily be placed into a Windows PowerShell script. (Source)

[FN-GM]

So i am likely to get the trust issue. On the MS forums someone put "If a computer is turned off for 6 weeks when it turns on again it will automatically renew its password."

 

The issue i could see if a laptop is being used at home for a period of time. I could always just set the policy for desktops.

[sted]

could you try it on a test vm with a test policy set for as short a period of time as you can then just turn vm off for a week os so see what happens?

 

as i suspect its one of those policies where ask 3 people and you will get 3 diff answers and its also liable to come back and bite you in the bum if you do roll it out

Edited March 5, 2012 by sted

[FN-GM]

could you try it on a test vm with a test policy set for as short a period of time as you can then just turn vm off for a week os so see what happens?

 

as i suspect its one of those policies where ask 3 people and you will get 3 diff answers and its also liable to come back and bite you in the bum if you do roll it out

 

Its funny you should say that. I did do that and i booted the machine forgetting i was testing